CRI-O CVE-2026-76061

Exploitation requires CRI-O to be explicitly configured with a non-empty bind_mount_prefix (the default is empty and is NOT affected), plus the attacker's ability to create a container specifying a CRI hostPath mount whose path contains an intermediate absolute symlink. Limiting factors: the non-default bind_mount_prefix setting, the need for privileges to define hostPath mounts (PR:H), high attack complexity in arranging the symlink so the source resolves outside the prefixed root (AC:H), and no required user interaction. Default-configured CRI-O deployments are not exposed.

This is a moderate, conditional risk rather than an urgent priority. The NVD CVSS of 5.5 (AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L) reflects high attack complexity and a high-privilege prerequisite, and there is no EPSS score, no CISA KEV listing, and no public exploit - only upstream fix commits are available (these are patches, not proof-of-concept exploit code). A notable conflict: the vector encodes AV:N (network), yet the description explicitly states the actor is 'a malicious container or local attacker' who must plant an intermediate absolute symlink and control a CRI hostPath - this is operationally a local/container-boundary attack, so AV:N appears overstated and should be verified with Red Hat. The scope change (S:C) and CWE-59 symlink resolution correctly capture the container-to-host trust-boundary crossing. Critically, the flaw only manifests when CRI-O is configured with a non-empty bind_mount_prefix, which is not the default, substantially narrowing the real-world exposed population. Net: a legitimate container-escape/privilege-escalation vector worth patching on affected OpenShift/Kubernetes nodes, but gated by non-default configuration, high privileges, and high complexity - not a mass-exploitation candidate.

On a node where CRI-O is configured with a non-empty bind_mount_prefix, an attacker who can create containers with CRI hostPath mounts supplies a hostPath whose intermediate path component is an absolute symlink. During bind-mount source resolution the symlink dereferences outside the intended prefixed root, so the container receives a bind mount of a sensitive host path, enabling unauthorized file access or privilege escalation on the host. No weaponized public exploit exists; only the upstream fix commits are available, and successful exploitation requires winning the symlink-resolution condition (AC:H).