REDHAT-BUG-2535436: High severity Red Hat cri-o vulnerability
nitial intake from PSIRTSUPT-23768. Ayato confirmed that CRI-O checkpoint restore can bypass the destination Kubernetes security context when restoring a malicious checkpointed container. Proposed impact is Critical with CVSS 9.9: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Affected upstream supported versions are >= 1.34, with Red Hat downstream impact from OCP 4.17 onward. Fixes are present in commits f4d95dfe70c4af4afff0c5a96e1a36975c2f65f9, 045d4107f10f9baa4e93d54a93762e0036942d4b, and bb54fa0fba793889d815e5943abd6f8afc938c39. Reporter: lyhtheori. CVE-2026-92574 reserved. Planned disclosure: 2026-09-21. Keep embargoed pending IC review and release confirmation.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects CRI-O checkpoint restore in upstream supported versions 1.34 and later. Red Hat downstream impact begins with OpenShift Container Platform 4.17.
What must an attacker be able to do to exploit this?
An attacker needs to restore a malicious checkpointed container through CRI-O checkpoint restore. The provided CVSS vector indicates network attack access, low attack complexity, low privileges, and no user interaction.
What is the security impact of a successful exploit?
A malicious checkpoint restore can bypass the destination Kubernetes security context. The proposed CVSS 3.1 score is 9.9, with high confidentiality, integrity, and availability impact and scope change.
How can I determine whether my environment needs remediation?
Determine whether CRI-O checkpoint restore is used and whether the environment runs an affected upstream version or OpenShift Container Platform 4.17 or later. The data identifies fixes by commits f4d95dfe70c4af4afff0c5a96e1a36975c2f65f9, 045d4107f10f9baa4e93d54a93762e0036942d4b, and bb54fa0fba793889d815e5943abd6f8afc938c39.