Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Azure CRI-O can let attackers run code as root
published 2 months ago
Summary
The CRI-O component used with Azure can load a configuration file specified by a pod without checking it. An attacker who can place a file on the host can trick the system into loading a malicious program, giving them full control of the server. Upgrade to the version released after 4.0.0 (or later) to stop this behavior.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | cri-o | <= 1.30.1-1 |
Original advisory text
CVE-2026-50540 affecting package cri-o 1.30.1-1
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to version 4.0.0, kata-runtime is vulnerable to host code execution via an unvalidated configuration path annotation. The runtime accepts an arbitrary io.katacontainers.config_path pod annotation and loads the referenced host TOML file without restriction. As a result, a pod user who can place a file at a host-visible path can supply a configuration that selects an attacker-controlled hypervisor or virtio-fs daemon binary, executing code as root on the host. This issue is fixed in version 4.0.0.
References
Timeline
Published7 Aug 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-94679 · OSV
Track software like this
Free during beta