{"id":"CVE-2026-92574","published":"2026-09-21T10:17:17.360","lastModified":"2026-09-22T19:37:36.747","description":"A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, no_new_privs, and seccomp state from the checkpoint instead of enforcing the destination configuration. This can allow execution with elevated privileges across the container security boundary.\nAffected upstream supported versions are CRI-O 1.34 and later. Downstream Red Hat products are affected from OCP 4.17 onward. Fixes have been applied to supported branches but are not yet released.\nExploitation requires permission to create a pod from a malicious checkpoint image and checkpoint restore functionality to be available.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-250"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-92574","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535436","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows a user to bypass Kubernetes security context by creating a pod from a malicious checkpointed container, potentially leading to elevated privileges.","exploitability":"Exploitation requires permission to create a pod from a malicious checkpoint image and checkpoint restore functionality to be available. This makes it moderately exploitable.","blast_radius":"If exploited, this can result in execution with elevated privileges across the container security boundary, impacting the entire Kubernetes cluster.","remediation":"Upgrade to CRI-O 1.34 or later, or disable checkpoint restore functionality.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","kubernetes","container","security-context"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-29T09:18:10.714Z"}}