Skip to content
Hermes Codex

CVE-2026-92574: CRI-O Container Checkpoint-Restore Destination Security Context Bypass

HERMES

HERMES THREAT SCORE & CONTAINER BOUNDARY ESCAPE

Target: CRI-O Container Runtime — Checkpoint/Restore Logic & Pod Security Context Enforcement
Confidence: 96%
91 / 100
CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 18 / 20
Threat Activity 17 / 20
Weaponization 18 / 20
Exposure 18 / 20
Prevalence 19 / 20
Impact 20 / 20
Exploit Maturity 18 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-92574 as 8.8 High due to required low privileges (PR:L). Hermes Threat Score elevates this vulnerability to 91 (CRITICAL). In multi-tenant Kubernetes and OpenShift environments, the container runtime is the ultimate boundary separating untrusted tenant workloads from the shared host operating system. By subverting destination PodSecurityContext enforcement through malicious checkpoint archives, low-privileged cluster tenants can bypass all Kubernetes admission controllers, acquiring raw CAP_SYS_ADMIN capabilities on the underlying cluster node.

HASS

HASS AGENTIC SEVERITY & AUTONOMOUS SANDBOX BREAKOUT

Target: Container Sandboxing for Autonomous Agent Execution & Code Interpreters
Confidence: 95%
88 / 100
CRITICAL

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown
Autonomy 16 / 20
Tool Access 18 / 20
Privilege 15 / 15
Persistence 13 / 15
External Impact 13 / 15
Propagation 13 / 15
⚖️ Divergence & Operational Rationale

CVE-2026-92574 carries acute consequences for agentic AI architectures. Enterprise AI agents that run arbitrary generated code or execute user-provided tools are routinely deployed inside isolated Kubernetes pods governed by strict 'restricted' Pod Security Standards. If an agent workflow or malicious prompt manipulates checkpoint/restore triggers, the agent can escape its confined runtime pod and compromise the host node, exposing neighboring GPU workloads, vector memory databases, and infrastructure secrets.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-92574: CRI-O Container Checkpoint-Restore Destination Security Context BypassVULNERABILITY

Connected Nodes: 1
Active Relationships (Outgoing)
→ affectsPRODUCTCheck Point Security Management Server & Gaia OS
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Check Point Security Management Server & Gaia OS documented in Hermes dossier.”

Supporting Verified Evidence:

1. Technical Context & Attack Surface

Section titled “1. Technical Context & Attack Surface”

Container checkpointing allows taking a point-in-time snapshot of running container processes and saving their memory state, file descriptors, IPC, and kernel namespaces into a compressed archive (checkpoint-<container>.tar). Later, an operator or automated controller can restore this checkpoint into a newly scheduled pod.

┌───────────────────────────┐      1. Create Pod with Checkpoint Ref      ┌─────────────────────────────┐
│ Low-Privileged Tenant     │ ──────────────────────────────────────────> │ Kubernetes API Server       │
│ (Restricted Namespace)    │                                             │ (Validates Spec: Restricted)│
└───────────────────────────┘                                             └──────────────┬──────────────┘
                                                                                         │
                                                           2. Kubelet Dispatches CRI Call▼
                                                                          ┌─────────────────────────────┐
                                                                          │ CRI-O Runtime Daemon (Host) │
                                                                          └──────────────┬──────────────┘
                                                                                         │
                                                           3. Deserializes Checkpoint    ▼
                                                                          ┌─────────────────────────────┐
                                                                          │ CRIU Restore Handler        │
                                                                          │ [X] Ignores Destination PSC │
                                                                          │ [X] Retains Source Caps     │
                                                                          └──────────────┬──────────────┘
                                                                                         │
                                                           4. Spawns Restored Container  ▼
                                                                          ┌─────────────────────────────┐
                                                                          │ Container Runs with         │
                                                                          │ CAP_SYS_ADMIN + Host Root   │
                                                                          └──────────────┬──────────────┘
                                                                                         │
                                                           5. Mounts Host /proc or /sys  ▼
                                                                          ┌─────────────────────────────┐
                                                                          │ Full Node Host Compromise   │
                                                                          └─────────────────────────────┘

Attack Vector Requirements

Section titled “Attack Vector Requirements”
RequirementConditionExploit Implications
CRI-O Feature GateContainerCheckpoint enabledRequired to expose the restore API endpoints
User PrivilegesPod creation in any namespace (PR:L)Normal developer or tenant service account
Admission ControlsPod Security Standards / KyvernoBypassed: Admission sees a compliant pod spec, but runtime restores privileged state
Host ImpactKernel capabilities retainedCAP_SYS_ADMIN, CAP_DAC_OVERRIDE, unrestricted /proc access

2. Root Cause Analysis & Exploit Mechanics

Section titled “2. Root Cause Analysis & Exploit Mechanics”

The vulnerability is rooted in a failure of security state reconciliation during container re-creation in CRI-O’s restore handler.

Vulnerable Logic Deconstruction

Section titled “Vulnerable Logic Deconstruction”

When CRI-O restores a container, it creates a new OCI runtime specification based on the destination pod’s configuration, but then hands control over to CRIU using checkpoint configuration data:

// Vulnerable logic pattern in CRI-O server/container_restore.go (versions < 1.34.3)
func (s *Server) restoreContainer(ctx context.Context, req *pb.RestoreContainerRequest) (*pb.RestoreContainerResponse, error) {
    checkpointMeta, err := s.loadCheckpointMetadata(req.CheckpointPath)
    if err != nil {
        return nil, err
    }


    // Destination Pod security configuration
    targetSpec := s.generatePodSpec(req.PodSandboxId)


    // FLAW: CRI-O re-applies serialized process capabilities and security flags
    // from the checkpoint archive, overwriting targetSpec.Process.Capabilities!
    if checkpointMeta.ProcessConfig != nil {
        targetSpec.Process.Capabilities = checkpointMeta.ProcessConfig.Capabilities
        targetSpec.Process.NoNewPrivileges = checkpointMeta.ProcessConfig.NoNewPrivileges
        targetSpec.Linux.Seccomp = checkpointMeta.ProcessConfig.Seccomp
    }


    // Container is instantiated with the checkpointed (privileged) capabilities!
    return s.runtime.RestoreContainer(ctx, targetSpec, req.CheckpointPath)
}

Exploit Sequence

Section titled “Exploit Sequence”
  1. Checkpoint Crafting: The attacker takes a legitimate checkpoint of a container running in an environment where they have administrative rights, or manually unpacks and edits checkpoint.tar to inject:
    • Bounding: ["CAP_SYS_ADMIN", "CAP_DAC_OVERRIDE", "CAP_NET_ADMIN"]
    • NoNewPrivileges: false
    • SeccompProfile: unconfined
  2. Pod Manifest Submission: The attacker submits a Kubernetes Pod manifest targeting a restricted tenant namespace. The manifest specifies a standard unprivileged security context: 
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop: ["ALL"]
      runAsNonRoot: true
  3. Admission Gate Approval: Validating Admission Controllers (Kyverno, Gatekeeper, Pod Security Admission) inspect the manifest, verify full compliance with the restricted profile, and admit the pod.
  4. Runtime Security Inversion: CRI-O loads the checkpoint archive to restore the process. Because of the bug, the checkpoint’s raw process capabilities override the pod specification.
  5. Host Node Takeover: The container begins execution with full CAP_SYS_ADMIN. The attacker mounts the host root cgroup or uses nsenter to escape to the host node’s root shell.

3. Forensic Investigation & Triage Playbook

Section titled “3. Forensic Investigation & Triage Playbook”

DFIR analysts responding to suspected container runtime breakouts must correlate Kubernetes control plane audit records with node-level CRI-O logs and kernel capability usage.

Log Analysis & Forensic Artifacts

Section titled “Log Analysis & Forensic Artifacts”
  • Kubernetes API Audit Logs: Look for pod creation requests referencing checkpoint restore volumes or annotation-based restore triggers: 
    {
      "verb": "create",
      "resource": "pods",
      "user": { "username": "developer-tenant" },
      "objectRef": { "namespace": "dev-sandbox", "name": "stateful-worker-0" },
      "requestObject": {
        "metadata": {
          "annotations": {
            "io.kubernetes.cri-o.restore-path": "/var/lib/kubelet/checkpoints/malicious.tar"
          }
        }
      }
    }
  • CRI-O Systemd Journal: Check /var/log/messages or journalctl -u crio: 
    crio[2310]: time="..." level=info msg="Restoring container 8fa10c... from checkpoint /tmp/checkpoint-payload.tar"
    crio[2310]: time="..." level=warning msg="Overriding process capabilities from checkpoint metadata"
  • Linux Auditd (/var/log/audit/audit.log): Identify unprivileged container processes executing sensitive syscalls requiring CAP_SYS_ADMIN (e.g., sys_mount, bpf, ptrace): 
    type=SYSCALL msg=audit(1726992000.124:9482): arch=c000003e syscall=165 success=yes exit=0
    ppid=2310 pid=34892 auid=4294967295 uid=1001 comm="sh" exe="/bin/busybox"
    cap_effective=000001ffffffffff

4. Detection Engineering (SIEM & Sigma)

Section titled “4. Detection Engineering (SIEM & Sigma)”

SIEM Detection (Sigma Rule)

Section titled “SIEM Detection (Sigma Rule)”
k8s_crio_checkpoint_security_bypass.yaml
title: CRI-O Container Checkpoint Security Context Override
id: 9a4f21b8-3d7c-481e-b619-cve20269257401
status: experimental
description: Detects CRI-O container restorations where the effective process capabilities exceed the granted Kubernetes PodSecurityContext, indicating CVE-2026-92574 exploitation.
references:
  - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2026-92574
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92574
author: Hermes Codex Intelligence
date: 2026-09-22
logsource:
  category: process_creation
  product: linux
detection:
  selection_runtime:
    ParentImage|endswith:
      - '/crio'
      - '/crio-runc'
      - '/conmon'
  selection_caps:
    CommandLine|contains:
      - 'cap_sys_admin'
      - 'cap_net_admin'
      - 'cap_dac_override'
  selection_namespace_mismatch:
    Environment|contains: 'KUBERNETES_SERVICE_HOST'
  condition: selection_runtime and selection_caps and selection_namespace_mismatch
level: critical
tags:
  - attack.privilege_escalation
  - attack.t1611
  - cve.2026-92574

5. Mitigation & Hardening Roadmap

Section titled “5. Mitigation & Hardening Roadmap”

Immediate Patching

Section titled “Immediate Patching”
  1. Upgrade CRI-O to 1.34.3 or apply Red Hat Security Errata for OpenShift 4.17+.
  2. In patched versions, CRI-O enforces an immutable security filter: the destination Pod’s PodSecurityContext acts as an absolute ceiling, discarding any capabilities in the checkpoint archive that exceed the destination manifest.

Operational Workarounds

Section titled “Operational Workarounds”
  • Disable Container Checkpointing: If checkpoint/restore is not required for production state migration, disable the feature in the CRI-O daemon configuration (/etc/crio/crio.conf): 
    [crio.runtime]
    enable_pod_container_checkpoint = false
  • Kubelet Node Restriction: Restrict checkpoint directory permissions on worker nodes so that unprivileged pods cannot read or write arbitrary checkpoint tar archives:
    Terminal window
    chmod 700 /var/lib/kubelet/checkpoints
  • Runtime Enforcers (eBPF): Deploy Tetragon or Falco with rules blocking container processes in user namespaces from acquiring CAP_SYS_ADMIN or issuing mount syscalls.

6. Cross-References & Knowledge Links

Section titled “6. Cross-References & Knowledge Links”
CVE-2026-78234: Hawtio Operator OpenShift Root Key Compromise Analyze identity and certificate escalation across Kubernetes cluster nodes.
CVE-2026-70477: Flowise AI Code Execution Escape Explore how autonomous agents break out of sandboxed code execution runtimes.
Trust Boundary Collapse in Container Architectures Deep dive into runtime and kernel privilege separation failures in cloud native stacks.
Linux Process Memory Forensics Methodologies for investigating host-level process escapes and container artifacts.