A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, nonewprivs, and seccomp state from the checkpoint instead of enforcing the destination configuration. This can allow execution with elevated privileges across the container security boundary. Affected upstream supported versions are CRI-O 1.34 and later. Downstream Red Hat products are affected from OCP 4.17 onward. Fixes have been applied to supported branches but are not yet released. Exploitation requires permission to create a pod from a malicious checkpoint image and checkpoint restore functionality to be available.
nitial intake from PSIRTSUPT-23768. Ayato confirmed that CRI-O checkpoint restore can bypass the destination Kubernetes security context when restoring a malicious checkpointed container. Proposed impact is Critical with CVSS 9.9: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Affected upstream supported versions are >= 1.34, with Red Hat downstream impact from OCP 4.17 onward. Fixes are present in commits f4d95dfe70c4af4afff0c5a96e1a36975c2f65f9, 045d4107f10f9baa4e93d54a93762e0036942d4b, and bb54fa0fba793889d815e5943abd6f8afc938c39. Reporter: lyhtheori. CVE-2026-92574 reserved. Planned disclosure: 2026-09-21. Keep embargoed pending IC review and release confirmation.
Important: OpenShift Container Platform 4.21.29 bug fix and security update
OpenShift Container Platform 4.14.71 bug fix and security update
OpenShift Container Platform 4.19.42 bug fix and security update
OpenShift Container Platform 4.18.52 bug fix and security update
OpenShift Container Platform 4.20.33 bug fix and security update
OpenShift Container Platform 4.15.67 bug fix and security update
OpenShift Container Platform 4.14.70 bug fix and security update
OpenShift Container Platform 4.20.30 bug fix and security update
RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
OpenShift Container Platform 4.12.93 bug fix and security update
OpenShift Container Platform 4.12.93 security and extras update
OpenShift Container Platform 4.17.55 bug fix and security update
RHTAS 1.4.2 - Red Hat Trusted Artifact Signer Release
OpenShift Container Platform 4.13.68 bug fix and security update
OpenShift Container Platform 4.20.26 bug fix and security update
OpenShift Container Platform 4.21.21 bug fix and security update
OpenShift Container Platform 4.22.2 bug fix and security update
OpenShift Container Platform 4.19.33 bug fix and security update
Important: OpenShift Container Platform 4.12.91 bug fix and security update
A flaw was found in the Cloud Credential Operator (CCO) Mint-mode CredentialsRequest manifests shipped with OpenShift Container Platform for AWS. The CredentialsRequest specifications for the Image Registry, Machine API, Ingress Operator, and EBS CSI Driver request IAM policies with Resource: "" for destructive actions (S3 CreateBucket/DeleteBucket/PutObject/DeleteObject, EC2 TerminateInstances/RunInstances, Route53 ChangeResourceRecordSets, EC2 DeleteVolume/DeleteSnapshot). This grants the provisioned operator IAM credentials access to any AWS resource in the account, not just resources owned by the cluster. An attacker who obtains these credentials (via pod compromise, RBAC escalation, or Secret read) can perform destructive operations against unrelated AWS resources in the same account, including deleting S3 buckets, terminating EC2 instances, modifying DNS records in unrelated hosted zones, and deleting EBS volumes belonging to other workloads or clusters.
Important: OpenShift Container Platform 4.14.65 bug fix and security update
Important: OpenShift Container Platform 4.19.28 bug fix and security update
The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.
Important: OpenShift Container Platform 4.18.17 bug fix and security update
Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.This advisory contains the container images for Red Hat OpenShift Container Platform 4.12.77. See the following advisory for the RPM packages for this release:https://access.redhat.com/errata/RHBA-2025:8304 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:https://docs.redhat.com/en/documentation/openshiftcontainerplatform/4.12/html/releasenotes Security Fix(es): libxslt: Use-After-Free in libxslt (xsltGetInheritedNsList) (CVE-2024-55549) libxslt: Use-After-Free in libxslt numbers.c (CVE-2025-24855) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshiftcontainerplatform/4.12/html-single/updatingclusters/index#updating-cluster-within-minor.
Important: OpenShift Container Platform 4.15.52 security and extras update
Important: OpenShift Container Platform 4.17.32 bug fix and security update
Important: OpenShift Container Platform 4.18.16 bug fix and security update