CRI-O: untrusted checkpoint archive on restore allows unintended host filesystem operations

Impact

When CRI-O restores a container from a checkpoint archive it does not validate the restore metadata sufficiently, so a sufficiently privileged user who can get an untrusted checkpoint restored can drive operations against the host filesystem rather than the container's. CVSS marks the scope as changed, which is the relevant part for a GPU operator: this is a container-to-host boundary failure on the node, and on a GPU node the host is where the driver, the device plugin and every other tenant's pod live. The practical blast radius depends on who in your cluster can submit a checkpoint and have it restored. The mitigating fact is configuration: checkpoint/restore is not enabled by default, and exploitation requires both that it is on and that an attacker can get untrusted checkpoint content restored, so most clusters are not exposed.

Who can reach it

Network-reachable cluster API path, authenticated and already holding high privileges, on a cluster where CRI-O checkpoint/restore is explicitly enabled and where the attacker can cause a container to be restored from checkpoint content they control.

What to do

First check whether checkpoint/restore is enabled at all - if it is not, you are not exposed and no maintenance window is needed. Where it is enabled, the cheap immediate mitigation is to disable the feature or stop restoring checkpoints from any source you do not control. To patch, take the CRI-O or OpenShift update from Red Hat's advisory for this CVE; a container runtime update means restarting CRI-O on each node, which restarts the pods on it, so plan it as a per-node drain across the fleet. Red Hat's page for the CVE carries the fixed versions; the NVD record does not state them.

References

Related entries

• Nuclio controller: cron trigger headers and body are injected into the CronJob shell commandCVE-2026-52831 · Nuclio controller (cron trigger rendered into Kubernetes CronJob args)High
• Strimzi Cluster Operator: attacker-set watchedNamespace grants Secret read/write in other namespacesCVE-2026-55225 · Strimzi Kafka Operator (Cluster Operator, Kafka.spec.entityOperator.watchedNamespace)High
• Nuclio dashboard: unvalidated function namespace is interpolated into a shell docker ps commandCVE-2026-79755 · Nuclio dashboard (local/Docker platform, function namespace filter)High
• Red Hat Quay quay-builder-qemu: release workflow pins a third-party action to a mutable branchCVE-2026-85469 · Red Hat Quay 3 quay-builder-qemu (GitHub release workflow)High
• Cilium: cilium-bugtool output contains sensitive dataCVE-2024-37307 · CiliumHigh
• Cilium: cilium-bugtool leaks sensitive data (recurrence of the 2024 issue)CVE-2026-41520 · CiliumHigh