8.0 High

CVE-2026-15801 Cri-o: cri-o: insufficient validation during container checkpoint restore

Description

A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to restore containers from checkpoint archives, insufficient validation of restore metadata may allow a user with sufficient privileges to perform unintended operations on the host filesystem. Successful exploitation requires that container checkpoint and restore functionality is enabled, which is not the default configuration. An attacker must also be able to trigger restoration of a container from untrusted checkpoint content.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Exploitable remotely over the network, with an administrator account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: High
Privileges required: High
Interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
Red Hat OpenShift Container Platform 4	Versions not published
Red Hat OpenShift Container Platform 5	Versions not published

References

access.redhat.com access.redhat.com
RHBZ#2500823 bugzilla.redhat.com

Timeline

Published September 21, 2026
Last modified November 4, 2026

The 629 CVEs of Red Hat OpenShift Container Platform 4 →

CVE-2026-82976 Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret 7.1 High CVE-2026-120831 Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service 6.5 Medium CVE-2026-120830 Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure 7.4 High CVE-2026-120194 Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step 7.5 High

Track this CVE