Executive brief
CRI-O is a container runtime that allows Kubernetes clusters to run containerized applications. When the checkpoint and restore feature is enabled, insufficient validation of checkpoint metadata could allow a privileged user to read, modify, or delete files on the host filesystem. This attack requires explicit feature enablement (not enabled by default) and high-level access to container runtime interfaces, but could result in complete host compromise if exploited.
Technical details
A path traversal vulnerability (CWE-22) exists in CRI-O's container checkpoint restore functionality due to insufficient validation of restore metadata. An attacker with high privileges who can trigger restoration of a container from untrusted checkpoint archives can perform unintended filesystem operations on the host. The vulnerability has network attack vector with high attack complexity and high privilege requirements; exploitation requires the non-default checkpoint/restore feature to be explicitly enabled.
Affected products
- CRI-O Project CRI-O
Timeline
- 2026-09-21: disclosed