CVE-2026-15801
Received Received - Intake

Insufficient Validation in CRI-O Checkpoint Restore

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: redhat-SADP

Description
A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to restore containers from checkpoint archives, insufficient validation of restore metadata may allow a user with sufficient privileges to perform unintended operations on the host filesystem. Successful exploitation requires that container checkpoint and restore functionality is enabled, which is not the default configuration. An attacker must also be able to trigger restoration of a container from untrusted checkpoint content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-15801
EUVD
EUVD-2026-83865

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat cri-o *
redhat openshift_container_platform *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-15801 is a vulnerability in CRI-O related to container checkpoint and restore functionality. It involves insufficient validation of restore metadata, which could allow a privileged user to perform unintended operations on the host filesystem when restoring containers from untrusted checkpoint archives.

Detection Guidance

Check if the container checkpoint and restore feature is enabled in CRI-O by inspecting configuration files like /etc/crio/crio.conf or /etc/containers/oci/hooks.d. Look for enabled checkpoint/restore settings. Verify if any containers have been restored from untrusted sources by reviewing container runtime logs and audit trails for restore operations.

Impact Analysis

This vulnerability could allow an attacker with sufficient privileges to perform unintended operations on the host filesystem, such as arbitrary file writes as root. This may lead to full node compromise, accessing sensitive files like SSH keys or system configurations, or causing denial of service.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data or host filesystems. Exploitation may lead to exposure of personal or health information, unauthorized modifications, or denial of service, which are violations of data protection requirements under these regulations.

Mitigation Strategies

Disable the container checkpoint and restore feature in CRI-O unless absolutely necessary. Restrict permissions to trusted administrators only. Avoid restoring containers from untrusted checkpoint archives. Monitor for suspicious restore operations in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15801. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart