VulnSocial

CVE-2026-15801Disclosure

LOWCVSS 8.0 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to restore containers from checkpoint archives, insufficient validation of restore metadata may allow a user with sufficient privileges to perform unintended operations on the host filesystem. Successful exploitation requires that container checkpoint and restore functionality is enabled, which is not the default configuration. An attacker must also be able to trigger restoration of a container from untrusted checkpoint content.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-21); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-21: 1Mentions · 2026-10-23: 1Patch / Workaround · 2026-10-23: 1Technical Details · 2026-10-23: 109-2110-23
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
By indicator
Classification over time
DateTotalLabels
2026-09-211
Disclosure1
2026-10-231
Patch1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity@HugoValters
    Patch

    CVE-2026-15801: CRI-O checkpoint/restore flaw lets privileged users write to the host filesystem via unvalidated restore metadata. CVSS 8, no patch yet. Disable checkpoint/restore if you don't need it and watch for fixes. #CVE #infosec #Kubernetes https://www.valtersit.com/cve/CVE-2026-15801/ #CRIO #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The tweet announces CVE-2026-15801, a CRI-O checkpoint/restore vulnerability (CVSS 8) allowing privileged users to write to the host filesystem via unvalidated restore metadata, with no patch yet and recommends disabling the feature as a workaround.

    0000040
    1.1K followersView on X
  • VulDB 🛡@vuldb
    Disclosure

    The severity is increased for this new vulnerability affecting Red Hat CRI-O (CVE-2026-15801) https://vuldb.com/vuln/408079

    Post summary

    The tweet reports that the severity of a newly discovered CVE‑2026‑15801 affecting Red Hat CRI‑O has been increased and points to a vulnerability database entry. No additional details such as proof‑of‑concept code, exploit tools, patches, or evidence of active exploitation are provided.

    00000131
    2.3K followersView on X

Explore more

Back to dashboard