CVE-2026-76061: Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass
A flaw was found in CRI-O's bindmountprefix handling. When configured with a non-empty bindmountprefix, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system.
Other sources
A security issue was found in CRI-O’s bindmountprefix handling where it is configured with non-empty bindmountprefix, a CRI hostPath containing an intermediate absolute symlink may cause the eventual bind mount source to resolve outside the inteneded prefixed root. bindmountprefix is used in deployments where CRI-O itself runs in a container and the real host root is mounted under a prefix such as /host. In this If kubernetes/CRI requests CRI-O to mount /var/lib/example it will mount /host/var/lib/example. The exploitation requires that the resulting path contains an intermediate absolute symlink.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue applies when CRI-O is configured with a non-empty bind_mount_prefix, a setup used when CRI-O runs in a container and the real host root is mounted below a prefix such as /host. Deployments without a non-empty bind_mount_prefix are not described as affected.
What must an attacker control for exploitation?
A malicious container or local attacker needs to cause Kubernetes or CRI to request a hostPath whose resolved path includes an intermediate absolute symlink. That symlink must cause the eventual bind-mount source to resolve outside the intended prefixed root.
What is the potential impact?
The bypass can expose files outside the intended prefixed root through the bind mount. This may result in unauthorized host-file access or privilege escalation on the host system.