# CVE-2026-92574: Cri-o: cri-o checkpoint restore bypasses destination security context

Status: published. Published: 2026-09-21. Updated: 2026-11-05.

A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, no_new_privs, and seccomp state from the checkpoint instead of enforcing the destination configuration. This can allow execution with elevated privileges across the container security boundary.
Affected upstream supported versions are CRI-O 1.34 and later. Downstream Red Hat products are affected from OCP 4.17 onward. Fixes have been applied to supported branches but are not yet released.
Exploitation requires permission to create a pod from a malicious checkpoint image and checkpoint restore functionality to be available.

## Remediation

- workaround: Upgrade (primary remediation): Update CRI-O to a fixed version once available: 1.36.6 (1.36.x branch), 1.35.9 (1.35.x branch), or 1.34.14 (1.34.x branch). For Red Hat OpenShift Container Platform, apply the corresponding OCP update when released.

Until the fix is applied, the following measures reduce exposure:

Disable checkpoint restore if not required: In OpenShift, container checkpoint/restore requires the ContainerCheckpoint feature gate, which is Tech Preview and not enabled by default. Clusters that have not explicitly enabled this feature gate are not exposed to this flaw. If it was enabled and is not actively needed, disable it. For standalone CRI-O, set enable_criu_support = false in crio.conf under [crio.runtime] and restart the CRI-O service.

Restrict pod creation privileges: Limit Kubernetes RBAC for the create and update verbs on pods, deployments, daemonsets, statefulsets, jobs, and cronjobs resources to trusted users and service accounts only. Exploitation requires the ability to schedule a pod referencing a malicious checkpoint image.

Enforce Pod Security Standards: Apply the restricted or baseline Pod Security Standard at the namespace level using Pod Security Admission. While this does not directly block checkpoint restore, it limits the security contexts an attacker can request, reducing the impact if combined with other controls.

Restrict container image registries: Use an image policy (e.g., OpenShift image policy, Kyverno, or OPA Gatekeeper) to allowlist trusted registries only. This prevents pods from pulling malicious checkpoint images hosted on attacker-controlled registries.

Identify and remediate previously restored containers: If checkpoint restore has been used with images from untrusted sources, stop, delete, and recreate those containers. The restored process state may not match the intended security context. (source: CNA: redhat)

## Affected products and versions

-  /  (cri-o): ≥ 1.34.0; < 1.34.14 (affected, semver); ≥ 1.35.0; < 1.35.9 (affected, semver); ≥ 1.36.0; < 1.36.6 (affected, semver). Source: CNA: redhat
- Red Hat / Confidential Compute Attestation (openshift-sandboxed-containers/osc-monitor-rhel9): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (container-tools:rhel8/conmon): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (container-tools:rhel8/podman): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (conmon): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (conmon): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (cri-o): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (kata-containers): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift4/cnf-tests-rhel8): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift4/microshift-bootc-rhel10): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift4/microshift-bootc-rhel9): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift4/ztp-site-generate-rhel8): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-8): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-9): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (ose-crio-credential-provider): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 5 (cri-o): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 5 (kata-containers): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 5 (openshift5/microshift-bootc-rhel10): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 5 (openshift5/microshift-bootc-rhel9): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 5 (openshift/ose-rhel-coreos-9): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 5 (ose-crio-credential-provider): Version range not reported. Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 8.8 (high); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; source: CNA: redhat

- CISA KEV: No listing in collected sources

- EPSS: 0.65% as of 2026-11-04; percentile 51.46%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-250

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/security/cve/CVE-2026-92574 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2535436 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-92574; retrieved 2026-11-05; source updated 2026-11-05

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-92574; retrieved 2026-11-05; source updated Not reported

Revision: 1c00b62691ec7220e775a19edc3d4a09829149c3553d93330678eb8db142fc7f

Canonical: https://y2.dev/cve/CVE-2026-92574

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.