CVE-2026-76061: Improper Link Resolution Before File Access ('Link Following') in Red Hat Red Hat OpenShift Container Platform 4

This vulnerability arises from improper link resolution before file access in CRI-O's bind_mount_prefix configuration. When a non-empty bind_mount_prefix is set, an attacker can supply a Container Runtime Interface hostPath containing an intermediate absolute symbolic link. This causes the bind mount source path to resolve outside the intended prefixed root directory, potentially allowing unauthorized access to host files or privilege escalation. The flaw affects multiple versions of CRI-O used in Red Hat OpenShift Container Platform 4 as specified.

Successful exploitation can lead to unauthorized access to files on the host system or privilege escalation, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 5.5 (medium severity), reflecting network attack vector with high attack complexity and required privileges, no user interaction, and a scope change.

Red Hat has published an advisory for CVE-2026-76061. Users should apply the official patches or updates as indicated in the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-76061. Patch status is confirmed by the vendor advisory. Until patched, avoid configurations with non-empty bind_mount_prefix or untrusted hostPaths that could contain absolute symlinks.