CVE-2026-92574
Received Received - Intake

CRI-O Checkpoint Restore Privilege Escalation Vulnerability

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: redhat-SADP

Description
A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, no_new_privs, and seccomp state from the checkpoint instead of enforcing the destination configuration. This can allow execution with elevated privileges across the container security boundary. Affected upstream supported versions are CRI-O 1.34 and later. Downstream Red Hat products are affected from OCP 4.17 onward. Fixes have been applied to supported branches but are not yet released. Exploitation requires permission to create a pod from a malicious checkpoint image and checkpoint restore functionality to be available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-92574
EUVD
EUVD-2026-83881

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
red_hat cri-o 1.34
red_hat openshift_container_platform 4.17

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-250 The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-92574 is a flaw in CRI-O's checkpoint restore feature. When a user restores a container from a malicious checkpointed image, the restored process keeps elevated credentials, Linux capabilities, and other security settings from the checkpoint instead of applying the destination pod's security context. This can allow privilege escalation or bypassing security boundaries.

Detection Guidance

To detect this vulnerability, check CRI-O version with 'crio --version' and verify if it is 1.34 or later. Inspect pod creation permissions via 'oc get clusterrolebinding' or 'kubectl get clusterrolebinding' for excessive privileges. Monitor for unauthorized pod restarts or suspicious checkpoint usage in logs with 'journalctl -u crio' or 'oc logs <pod-name>'.

Impact Analysis

If exploited, this vulnerability could let an attacker gain elevated privileges, such as root access, or bypass security controls. It requires the ability to create pods from malicious checkpoint images and the checkpoint restore feature to be enabled. Systems running affected CRI-O or OpenShift versions are at risk.

Compliance Impact

This vulnerability could lead to unauthorized access or privilege escalation, potentially violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations using affected CRI-O or OpenShift versions may face compliance risks until patches are applied.

Mitigation Strategies

Immediately restrict pod creation permissions using RBAC by modifying cluster roles. Disable checkpoint restore if unused via CRI-O configuration. Enforce Pod Security Standards and limit container registries to trusted sources. Monitor for updates and apply patches once released by upgrading to fixed versions (1.36.6, 1.35.9, or 1.34.14).

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92574. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart