CVE-2026-15801: Cri-o: cri-o: insufficient validation during container checkpoint restore
A flaw was discovered in CRI-O's checkpoint and restore capability. If a container is restored from a checkpoint archive, CRI-O does not adequately validate the restore metadata. A sufficiently privileged user could therefore cause unintended host filesystem activity during the restore process. This behavior is only reachable when checkpoint and restore has been explicitly enabled; it is not active in the default CRI-O/OpenShift configuration. Exploitation also depends on the attacker being able to initiate a restore operation using checkpoint data that they control or supply.
Other sources
A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to restore containers from checkpoint archives, insufficient validation of restore metadata may allow a user with sufficient privileges to perform unintended operations on the host filesystem. Successful exploitation requires that container checkpoint and restore functionality is enabled, which is not the default configuration. An attacker must also be able to trigger restoration of a container from untrusted checkpoint content.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure CRI-O checkpoint/restore is not enabled and that CRI-O is not configured to restore containers from checkpoint archives, since the vulnerability is reachable only when checkpoint and restore has been explicitly enabled.
CRI-O container checkpoint and restore restore from checkpoint archives (checkpoint/restore feature) = disable (keep not enabled)
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only CRI-O deployments where container checkpoint and restore has been explicitly enabled are exposed. The feature is not active in the default CRI-O or OpenShift configuration.
What access does an attacker need to exploit it?
The attacker needs sufficient privileges to initiate a container restore operation and must be able to control or supply the checkpoint archive used for that restore. Remote reachability alone is not sufficient.
What is the potential impact of successful exploitation?
A successful exploit may cause unintended operations on the host filesystem during restoration of the container checkpoint.