What is the CVSS score of CVE-2026-104795?

CVE-2026-104795 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-104795?

Within 24 hours, confirm whether Red Hat OpenShift Container Platform 4 clusters run the insights-runtime-extractor DaemonSet; if the feature is not essential, disable or suspend that DaemonSet and block low-privileged tenants from scheduling pods onto sensitive nodes using SCCs, taints, node selectors, and RBAC. Within 7 days, review all pod-scheduling permissions and namespace isolation, restrict access to the host CRI-O socket, enable audit logging for suspicious binaries or setuid(0) activity, and monitor Red Hat advisories for a fixed OCP 4 z-stream release. Within 30 days, apply the vendor-released patch as soon as it is available, validate the upgrade in a staging cluster, and re-audit tenant isolation controls; until then, maintain the interim restrictions and monitor for signs of exploitation. No vendor-released patch identified at time of analysis; no public exploit identified at time of analysis.

OpenShift Container Platform CVE-2026-104795

EUVD-2026-100981 HIGH

Execution with Unnecessary Privileges (CWE-250)

2026-10-14 redhat

GHSA-98f3-7g2j-289q

Privilege Escalation Python Red Hat Red Hat Openshift Container Platform 4 Red Hat

8.8

CVSS 3.1 · Vendor: redhat

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Schedule pod in any namespace
Delivery

Set argv[0] to matched executable pattern
Exploit

DaemonSet scans and setns into container
Install

Extractor execs malicious binary with ruid=0
C2

Binary calls setuid(0) restoring CAP_SYS_ADMIN
Execute

Reach host CRI-O socket via cwd
Impact

Full node compromise

Vulnerability Assessment

Weakness	CWE CWE-250 ASVS 5.0 V8 - Authorization Unnecessary privilege execution
Exploitation Conditions	Preconditions: (1) the privileged insights-runtime-extractor DaemonSet (hostPID: true) must be deployed and actively scanning on the target node; (2) the attacker must have rights to schedule a pod in any namespace (unprivileged tenant); (3) the pod's process argv[0] (read from /proc/<pid>/cmdline) must match a configured versioned-executable pattern - specifically 'node', 'python', 'python3', 'MainThread', or any path containing 'java'; (4) the binary at that path must be attacker-controlled and call setuid(0) to restore the real UID 0 that the extractor failed to drop. The check_no_privileged_perms() guard is bypassed because it inspects only the effective capability set and is skipped entirely for uid-0 target containers. Limiting factors that reduce real-world exposure: the vulnerability is LOCAL (AV:L) and not network-reachable - the attacker must be able to run a workload on the node; it is irrelevant on clusters that do not run the insights-runtime-extractor; and it depends on the DaemonSet's automatic scan cycle executing (which it does without operator action). No end-user interaction is required.
Impact	CVSS 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) frames this as high-severity but LOCAL-vector: exploitation requires the attacker to schedule a workload on the node (PR:L, an authenticated low-privilege tenant), not a network request, so AV:L is correct and this is not internet-facing or mass-exploitable. The signal that elevates practical risk is the automatic trigger - the privileged insights-runtime-extractor DaemonSet scans all container processes on the node on its own, so once an attacker's crafted pod is scheduled the exploit fires reliably with no victim interaction (UI:N, AC:L), and S:C reflects a genuine container-to-host escape ending in full node compromise via the host CRI-O socket. Weighing the signals: no EPSS score, KEV status, SSVC decision data, or public POC is present in the input, so there is no evidence of active or at-scale exploitation - risk is latent rather than confirmed in-the-wild. Net: this is a real, high-priority issue for any multi-tenant OpenShift cluster actually running the insights-runtime-extractor component (reliable automated privilege escalation from an unprivileged pod to root on the node), but the local vector, the dependency on that specific component being deployed, and the absence of exploitation telemetry mean it is not a drop-everything internet-wide emergency. Missing EPSS/KEV/SSVC data should be resolved against Red Hat errata before final prioritization.
Exploit ScenarioDerived	An unprivileged tenant in a shared OpenShift cluster schedules a pod whose main binary's argv[0] matches a scanned versioned-executable pattern (e.g. node, python3, or a java path) and whose binary immediately calls setuid(0). When the insights-runtime-extractor DaemonSet performs its automatic runtime fingerprint scan, it setns() into the pod and execs that attacker binary while the real UID is still 0 in the host user namespace, letting the binary restore full root with CAP_SYS_ADMIN and reach the host CRI-O socket via the orphaned cwd - escalating to full node compromise. No public exploit identified at time of analysis; the attack is local and requires only pod-scheduling rights.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 14, 2026

Privilege escalation in Red Hat OpenShift Container Platform 4's insights-runtime-extractor DaemonSet lets an authenticated low-privileged tenant who can schedule a pod on a node run attacker-controlled code as root in the host user namespace. The extractor scanner enters the workload's namespaces and executes the workload's argv[0] via exec.Command after only seteuid() has changed, leaving real/saved UID 0 and retaining capabilities; a malicious pod binary matching node, python, python3, MainThread, or any path containing java can call setuid(0) and reach the host CRI-O socket from the inherited cwd. CVSS 8.8 (AV:L/PR:L/S:C) reflects local, non-network exploitation requiring workload scheduling, and no public exploit was identified at time of analysis.

RemediationAI

No vendor-released patch identified at time of analysis. Monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-104795 and Bugzilla at https://bugzilla.redhat.com/show_bug.cgi?id=2543917, and apply the vendor fix as soon as it is released. Until a patched build is available, if runtime fingerprinting is not required, disable or remove the insights-runtime-extractor DaemonSet or the corresponding Insights runtime extraction feature; the trade-off is loss of runtime fingerprinting and associated Insights data. If the extractor must remain, isolate it to trusted nodes and prevent untrusted tenants from scheduling pods there using taints, tolerations, and node selectors, and consider admission policies that block untrusted pods whose argv[0] matches node, python, python3, MainThread, or contains java; trade-offs are reduced scheduling flexibility and potential breakage of legitimate workloads with those process names. Restricting or removing the hostPath mount of the CRI-O socket from the extractor reduces post-exploitation reach but may break CRI-O interactions and does not eliminate the root execution primitive. Monitor for unexpected setuid-root executions and for extractor child processes running workload binaries as detective controls.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw is CWE-250, execution with unnecessary privileges, in the insights-runtime-extractor DaemonSet running with hostPID true. The coordinator forks, joins the target container's PID and mount namespaces, returns to an orphaned FD pointing at the extractor's own root filesystem where the host CRI-O socket is hostPath-mounted, and then calls only seteuid(target_uid). That leaves the real UID and saved-set-UID at 0 and retains the permitted capability set; the check_no_privileged_perms guard inspects only the Effective capability set and is skipped entirely when the target process runs as uid 0. The VersionExecutable fingerprint forwards process.command_line[0], which is read from /proc/<pid>/cmdline and fully controlled by the workload, into fpr_kind_executable, which calls exec.Command(executable, "--version").Output(). This executes the workload's own binary inside the workload's mount namespace while ruid remains 0 in the host user namespace. The executed process can call setuid(0) to restore full root with CAP_SYS_ADMIN and inherits the orphaned cwd that resolves into the extractor container filesystem containing the host CRI-O socket. The affected CPE is cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*. This is a local privilege-escalation path, not a remote network issue.

Know when Python gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Local because the attacker must run a pod on the node; PR:L for an authenticated tenant with pod-scheduling rights; scope changes from container to host, yielding full C/I/A.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat 8.8 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

The insights-runtime-extractor runs as a privileged DaemonSet (hostPID: true) that scans container processes for runtime fingerprinting. When scanning a container, the coordinator:

fork()s a child process
setns() into the target container's PID and mount namespaces
fchdir() back to an orphaned FD pointing at the extractor's own root

filesystem (where /crio.sock is hostPath-mounted)

Calls only seteuid(target_uid) - changing the effective UID but leaving

the real UID and saved-set-UID at 0 and retaining the permitted capability set

The check_no_privileged_perms() guard inspects only the Effective capability

set (so it passes), and is skipped entirely when the target runs as uid 0

The VersionExecutable fingerprint invokes fpr_kind_executable with

process.command_line[0] - the target's argv[0], read from /proc/<pid>/cmdline and fully controlled by the workload

fpr_kind_executable calls exec.Command(executable, "--version").Output()

executing the workload's own binary inside the workload's mount

namespace while ruid=0 in the host user namespace

The executed process can call setuid(0) to restore full root with CAP_SYS_ADMIN, and inherits the orphaned cwd which resolves into the extractor container's filesystem containing the host CRI-O socket.

Affected Code

1. Insufficient privilege drop (Rust - extractor coordinator)

File: extractor/src/insights_runtime_extractor.rs

rust

// Lines 139-146 - seteuid-only drop, guard skipped for root containers
join_process_namespaces(process.pid)?;
change_dir(current_dir);
switch_user(*process.uid)?;
if *process.uid != 0 {
    perms::check_no_privileged_perms()
        .expect("Must not have privileged permissions to run fingerprints");
}
fingerprint::run_fingerprints(&config, out_dir, &process);

rust

// Lines 182-185 - only effective UID changed; ruid/suid stay 0
fn switch_user(uid: u32) -> Result<(), ScannerError> {
    debug!("... Becoming user: {uid}");
    seteuid(uid.into()).map_err(|e| ScannerError::Errno(e))
}

2. Execution of untrusted binary (Go - fingerprint)

File: fingerprints/pkg/utils/file.go

// Lines 75-80 - executes a path taken verbatim from workload's argv[0]
func GetExecutableVersionOutput(executable string) (string, error) {
    out, err := exec.Command(executable, "--version").Output()
    if err != nil {
        return "", err
    }
    return string(out), nil
}

3. Workload-controlled path forwarded (Rust - version_executable)

File: version_executable.rs

rust

// Lines 29-34 - workload-controlled command_line[0] forwarded to fingerprint
return Some(vec![
    fpr_kind_executable,
    out_dir.to_string(),
    String::from(&process.command_line[0]),
    String::from(&version_executable.runtime_kind_name),
]);

Attack Pattern

Attacker: Any tenant able to schedule a pod (unprivileged, any namespace) Victim: The node running the insights-runtime-extractor DaemonSet Trigger: Automatic - the DaemonSet scans all container processes on the node

Attack sequence:

Attacker creates a pod whose process name matches a configured

versioned-executable pattern (node, python, python3, MainThread, or contains java)

The pod's main binary (at the path matching argv[0]) is a malicious

executable that calls setuid(0) to restore root

When the insights operator triggers a scan, the DaemonSet forks, enters the

attacker's mount namespace, and executes the attacker's binary with ruid=0

The attacker's code regains full root with CAP_SYS_ADMIN in the host user

namespace

The inherited cwd contains the host CRI-O socket → full node compromise

Executive ViewAI

Why It Matters

Red Hat OpenShift Container Platform 4 clusters running the insights-runtime-extractor DaemonSet are exposed to a high-severity local privilege escalation that can let an authenticated low-privileged tenant with pod scheduling rights reach root on the host. This undermines tenant isolation and can lead to node compromise, data exposure, or lateral movement across hosted workloads. Because no vendor-released patch is available and no public exploit has been identified at time of analysis, leadership should prioritize containment and monitoring in multi-tenant or shared OpenShift environments.

Business Impact: High

Compensating Controls

Disable or constrain the insights-runtime-extractor DaemonSet, prevent untrusted tenants from scheduling pods on sensitive nodes via SCCs, taints, node selectors, and RBAC, isolate affected nodes, restrict CRI-O socket access, and monitor for setuid(0) or unusual child-process execution. No vendor-released patch identified at time of analysis.

Threat Intelligence Overview

EPSS Score

0.2%

Top 95% exploitable

Prevalence

Medium

specific OpenShift runtime-fingerprinting add-on, not enabled in all clusters

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.