CVE-2026-15801

{
  "etk_id": "ETK-2026-472",
  "cve_id": "CVE-2026-15801",
  "display_id": "CVE-2026-15801",
  "ghsa_id": "GHSA-399r-2whw-f7gg",
  "euvd_id": "EUVD-2026-83865",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Checkpoint restore path injection in CRI-O",
  "summary": "CRI-O can use a path from untrusted checkpoint restore metadata when writing restored container content, allowing writes on the node with root privileges. Exploitation requires checkpoint restore to be enabled, an attacker able to create pods, and a node configured to pull attacker-controlled checkpoint content from an allowed registry; this can lead to node compromise.",
  "mitigation": "Upgrade unnamed to 1.37.1, 1.36.6, 1.35.9, 1.34.14 or later.",
  "vendor": "Red Hat",
  "product": "Red Hat OpenShift Container Platform 4",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<=1.37.0",
        "<=1.36.5",
        "<=1.35.8",
        "<=1.34.13"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.37.1",
        "1.36.6",
        "1.35.9",
        "1.34.14"
      ],
      "package_name": null,
      "purl": null
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 8,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": 0.0032,
  "epss_percentile": 0.2366,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 20.426340166666666,
  "t0_at": "2026-09-21T08:15:45.963000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-09-21T08:15:45.963000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-21T08:15:45.963000+00:00",
      "url": "https://github.com/cri-o/cri-o/security/advisories/GHSA-399r-2whw-f7gg"
    }
  }
}