Is CVE-2026-92574 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92574 being exploited in the wild.

How severe is CVE-2026-92574?

High severity, with a CVSS score of 8.8, published 21 September 2026.

Which products and versions are affected?

CRI-O 1.34 and later; Red Hat OpenShift Container Platform 4.17 and later.

Is there a fix for CVE-2026-92574?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-92574 attacked?

It is attacked over the network.

Am I affected by CVE-2026-92574?

Check whether you run CRI-O or Red Hat OpenShift Container Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92574: CRI-O checkpoint restore security context bypass

CVE-2026-92574 · Severity: high · CVSS 8.8 · Published 2026-09-21

CRI-O is a container runtime used in Kubernetes environments to execute and manage containers. A vulnerability in its checkpoint restore feature allows an attacker with permission to create pods to bypass Kubernetes security policies and execute containers with elevated privileges (root and full capabilities), even when the pod specification requires restricted permissions. This can be exploited remotely by pulling a malicious checkpoint image from a registry.

Technologies: CRI-O, Red Hat OpenShift Container Platform. Vendors: CRI-O, Red Hat.

Quick answers

Is CVE-2026-92574 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92574 being exploited in the wild.
How severe is CVE-2026-92574?: High severity, with a CVSS score of 8.8, published 21 September 2026.
Which products and versions are affected?: CRI-O 1.34 and later; Red Hat OpenShift Container Platform 4.17 and later.
Is there a fix for CVE-2026-92574?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-92574 attacked?: It is attacked over the network.
Am I affected by CVE-2026-92574?: Check whether you run CRI-O or Red Hat OpenShift Container Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in CRI-O's checkpoint restore implementation, which fails to enforce the destination Kubernetes security context when restoring from checkpointed container images. Instead, CRIU restores process credentials, Linux capabilities, no_new_privs bit, and seccomp state directly from the checkpoint archive, allowing an attacker to craft a malicious checkpoint image that executes with root privileges and full capabilities regardless of the pod's specified security context. Attack requires pod creation privileges and checkpoint restore functionality enabled (not enabled by default in OpenShift but enabled by default in standalone CRI-O).

Affected products

CRI-O CRI-O 1.34 and later
Red Hat OpenShift Container Platform 4.17 and later

Timeline

2026-09-21: disclosed
other: Fixes applied to supported branches but not yet released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.