CVE-2026-76061

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: redhat-SADP

Description

A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-76061

EUVD

EUVD-2026-93915

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability is in CRI-O's handling of bind mount prefixes. If configured with a non-empty prefix, an attacker could exploit a symlink in a hostPath to redirect the bind mount outside the intended directory. This may allow unauthorized file access or privilege escalation on the host system.

Detection Guidance

To detect this vulnerability, inspect CRI-O configurations for non-empty bind_mount_prefix settings. Check for containers using hostPath with absolute symlinks. Review CRI-O logs for unusual mount operations or unauthorized file access attempts.

Impact Analysis

An attacker with access to create containers could exploit this to read sensitive files or gain elevated privileges on the host. This could lead to data breaches, system compromise, or unauthorized modifications to critical system files.

Compliance Impact

This vulnerability could lead to unauthorized data access or exposure, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Compliance may be compromised if sensitive data is accessed or exfiltrated due to this flaw.

Mitigation Strategies

Disable or avoid using a non-empty bind_mount_prefix configuration in CRI-O. Ensure all hostPath entries in container configurations are validated to prevent symlink traversal. Monitor for unauthorized file access or privilege escalation attempts on the host.

Hi! I’m here to help you understand CVE-2026-76061. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70