CRI-O: restored checkpoints re-apply archive mounts, bypassing pod-spec host mount validation

Impact

CRI-O restores a container's mounts from the checkpoint archive rather than from the validated pod spec, so the admission and pod-spec checks that normally decide which host paths a container may see do not apply to a restored container. Someone able to call the restore endpoint can bring up a pod holding host mounts it was never authorized for, which on a GPU node means reaching host paths such as device nodes, driver state, or kubelet credentials outside the tenant's namespace. On a shared GPU cluster this collapses the boundary that keeps one tenant's workload off the host filesystem. Exploitation requires access to the kubelet or CRI-O socket, which is itself a privileged position, so this is an escalation of an already-elevated foothold rather than a path in from a plain pod.

Who can reach it

A local actor with access to the kubelet or CRI-O socket on the node - authenticated/privileged access to that socket is required; it is not reachable from an ordinary unprivileged pod.

What to do

Update CRI-O to a fixed build via the Red Hat errata for your OpenShift or RHEL stream and restart the CRI-O daemon on each node, which restarts the containers on that node - in practice, drain and roll nodes one at a time. If checkpoint/restore is not used, keeping the feature disabled removes the exposure without a node roll.

References

Related entries

• Podman: files written to bind mounts during build persist in the host build context directoryCVE-2025-4953 · Podman (podman build, RUN --mount=type=bind)High
• Strimzi: generated Role grants Kafka Connect and MirrorMaker 2 GET on all Secrets in the namespaceCVE-2025-66623 · Strimzi Kafka Operator (generated Role for Kafka Connect / MirrorMaker 2)High
• BentoML (bentofile.yaml path fields: description, docker.setup_script, docker.dockerfile_templateCVE-2026-24123 · BentoMLHigh
• OpenShift Console: tenant-planted Helm repository makes the console pod fetch arbitrary URLs server-sideCVE-2026-50237 · Red Hat OpenShift Console (Helm catalog proxy, ProjectHelmChartRepository)High
• Envoy Gateway: unauthenticated xDS on port 18000 hands out TLS private keys and full routing configCVE-2026-53714 · Envoy Gateway xDS gRPC server in GatewayNamespaceMode (port 18000)High
• Envoy: stored XSS through unescaped dynamic statistic names on the admin stats pageCVE-2026-73546 · Envoy (admin /stats?format=html StatsHtmlRender)High