Database/Container, Kubernetes & orchestration
CRI-O: arbitrary systemd property injection via a pod annotation gives action on the host
Impact
Anyone able to create a pod carrying an arbitrary annotation can have CRI-O set an arbitrary systemd property on the container's scope unit, which translates into arbitrary action on the node. On a GPU fleet the blast radius is the whole node: the driver state, every co-tenant container on it, the /dev/nvidia* device nodes, and whatever credentials the kubelet holds. The CVSS PR:H rating reflects an assumption about who can set annotations; on multi-tenant clusters where namespace users submit their own pod specs, that is effectively any tenant. Red Hat's record ties this to OpenShift 4.12-4.15 and 3.11.
Who can reach it
Any authenticated Kubernetes user who can create a pod with arbitrary annotations in a namespace that schedules onto CRI-O nodes. No node or host access needed.
What to do
Update CRI-O and restart it on every node (RHSA-2024:2669, 2672, 2784, 3496 cover the affected OpenShift streams). Restarting CRI-O recycles the container runtime, so on GPU nodes running long training jobs this has to be a rolling drain-and-update rather than an in-place daemon bounce. Until nodes are updated, an admission policy that rejects unknown or non-allowlisted pod annotations blocks the delivery path.
References
Related entries
- Docker Engine: docker cp of a compressed archive runs the container's own xz/unpigz with daemon privilegesCVE-2026-41567 · Docker Engine / moby daemon (docker cp archive decompression)High
- Docker / moby: Race condition during `docker cp` mount setup allows escape/host accessCVE-2026-42306 · Docker / mobyHigh
- BuildKit: crafted upload request writes files outside the daemon-controlled state directoryCVE-2026-75593 · BuildKit daemon (build context upload / state directory)High
- Cilium (VLAN interface datapath, TCX attachment): Ingress host policies and L7 network policies silently stop beingNCVD-2026-047-cilium-vlan-interface-datapath-t · Cilium (VLAN interface datapath, TCX attachment)High
- Argo Workflows (Argo Server, HTML artifact serving): A workflow can emit an HTML artifact containing script that, whenCVE-2022-29164 · Argo Workflows (Argo Server, HTML artifact serving)High
- Podman: Incorrect supplementary group handlingCVE-2022-2989 · PodmanHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.