CVE-2026-104795 (GCVE-0-2026-104795)
Vulnerability from cvelistv5
Published
2026-10-14 10:55
Modified
2026-10-20 13:02
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-250 - Execution with Unnecessary Privileges
Summary
The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`)
that scans container processes for runtime fingerprinting. When scanning a
container, the coordinator:
1. **fork()s** a child process
2. **setns()** into the target container's PID and mount namespaces
3. **fchdir()** back to an orphaned FD pointing at the extractor's own root
filesystem (where `/crio.sock` is hostPath-mounted)
4. Calls **only `seteuid(target_uid)`** — changing the effective UID but leaving
the **real UID and saved-set-UID at 0** and **retaining the permitted
capability set**
5. The `check_no_privileged_perms()` guard inspects only the Effective capability
set (so it passes), and is **skipped entirely when the target runs as uid 0**
6. The `VersionExecutable` fingerprint invokes `fpr_kind_executable` with
`process.command_line[0]` — the target's argv[0], read from
`/proc/<pid>/cmdline` and **fully controlled by the workload**
7. `fpr_kind_executable` calls `exec.Command(executable, "--version").Output()`
— executing the **workload's own binary** inside the workload's mount
namespace while **ruid=0 in the host user namespace**
The executed process can call `setuid(0)` to restore full root with
`CAP_SYS_ADMIN`, and inherits the orphaned cwd which resolves into the extractor
container's filesystem containing the host CRI-O socket.
## Affected Code
### 1. Insufficient privilege drop (Rust — extractor coordinator)
**File:** `extractor/src/insights_runtime_extractor.rs`
```rust
// Lines 139-146 — seteuid-only drop, guard skipped for root containers
join_process_namespaces(process.pid)?;
change_dir(current_dir);
switch_user(*process.uid)?;
if *process.uid != 0 {
perms::check_no_privileged_perms()
.expect("Must not have privileged permissions to run fingerprints");
}
fingerprint::run_fingerprints(&config, out_dir, &process);
```
```rust
// Lines 182-185 — only effective UID changed; ruid/suid stay 0
fn switch_user(uid: u32) -> Result<(), ScannerError> {
debug!("... Becoming user: {uid}");
seteuid(uid.into()).map_err(|e| ScannerError::Errno(e))
}
```
### 2. Execution of untrusted binary (Go — fingerprint)
**File:** `fingerprints/pkg/utils/file.go`
```go
// Lines 75-80 — executes a path taken verbatim from workload's argv[0]
func GetExecutableVersionOutput(executable string) (string, error) {
out, err := exec.Command(executable, "--version").Output()
if err != nil {
return "", err
}
return string(out), nil
}
```
### 3. Workload-controlled path forwarded (Rust — version_executable)
**File:** `version_executable.rs`
```rust
// Lines 29-34 — workload-controlled command_line[0] forwarded to fingerprint
return Some(vec![
fpr_kind_executable,
out_dir.to_string(),
String::from(&process.command_line[0]),
String::from(&version_executable.runtime_kind_name),
]);
```
## Attack Pattern
**Attacker:** Any tenant able to schedule a pod (unprivileged, any namespace)
**Victim:** The node running the insights-runtime-extractor DaemonSet
**Trigger:** Automatic — the DaemonSet scans all container processes on the node
**Attack sequence:**
1. Attacker creates a pod whose process name matches a configured
versioned-executable pattern (`node`, `python`, `python3`, `MainThread`,
or contains `java`)
2. The pod's main binary (at the path matching argv[0]) is a malicious
executable that calls `setuid(0)` to restore root
3. When the insights operator triggers a scan, the DaemonSet forks, enters the
attacker's mount namespace, and executes the attacker's binary with ruid=0
4. The attacker's code regains full root with `CAP_SYS_ADMIN` in the host user
namespace
5. The inherited cwd contains the host CRI-O socket → full node compromise
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4.21 |
Unaffected: 1792008935 < * cpe:/a:redhat:openshift:4.21::el9 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104795",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T15:25:50.103511Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:26:53.109Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift:4.21::el9"
],
"defaultStatus": "affected",
"packageName": "openshift4/insights-runtime-extractor-rhel9",
"product": "Red Hat OpenShift Container Platform 4.21",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1792008935",
"versionType": "rpm"
}
]
}
],
"datePublic": "2026-10-14T09:47:53.272Z",
"descriptions": [
{
"lang": "en",
"value": "The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`)\nthat scans container processes for runtime fingerprinting. When scanning a\ncontainer, the coordinator:\n\n1. **fork()s** a child process\n2. **setns()** into the target container\u0027s PID and mount namespaces\n3. **fchdir()** back to an orphaned FD pointing at the extractor\u0027s own root\n filesystem (where `/crio.sock` is hostPath-mounted)\n4. Calls **only `seteuid(target_uid)`** \u2014 changing the effective UID but leaving\n the **real UID and saved-set-UID at 0** and **retaining the permitted\n capability set**\n5. The `check_no_privileged_perms()` guard inspects only the Effective capability\n set (so it passes), and is **skipped entirely when the target runs as uid 0**\n6. The `VersionExecutable` fingerprint invokes `fpr_kind_executable` with\n `process.command_line[0]` \u2014 the target\u0027s argv[0], read from\n `/proc/\u003cpid\u003e/cmdline` and **fully controlled by the workload**\n7. `fpr_kind_executable` calls `exec.Command(executable, \"--version\").Output()`\n \u2014 executing the **workload\u0027s own binary** inside the workload\u0027s mount\n namespace while **ruid=0 in the host user namespace**\n\nThe executed process can call `setuid(0)` to restore full root with\n`CAP_SYS_ADMIN`, and inherits the orphaned cwd which resolves into the extractor\ncontainer\u0027s filesystem containing the host CRI-O socket.\n\n## Affected Code\n\n### 1. Insufficient privilege drop (Rust \u2014 extractor coordinator)\n\n**File:** `extractor/src/insights_runtime_extractor.rs`\n\n```rust\n// Lines 139-146 \u2014 seteuid-only drop, guard skipped for root containers\njoin_process_namespaces(process.pid)?;\nchange_dir(current_dir);\nswitch_user(*process.uid)?;\nif *process.uid != 0 {\n perms::check_no_privileged_perms()\n .expect(\"Must not have privileged permissions to run fingerprints\");\n}\nfingerprint::run_fingerprints(\u0026config, out_dir, \u0026process);\n```\n\n```rust\n// Lines 182-185 \u2014 only effective UID changed; ruid/suid stay 0\nfn switch_user(uid: u32) -\u003e Result\u003c(), ScannerError\u003e {\n debug!(\"... Becoming user: {uid}\");\n seteuid(uid.into()).map_err(|e| ScannerError::Errno(e))\n}\n```\n\n### 2. Execution of untrusted binary (Go \u2014 fingerprint)\n\n**File:** `fingerprints/pkg/utils/file.go`\n\n```go\n// Lines 75-80 \u2014 executes a path taken verbatim from workload\u0027s argv[0]\nfunc GetExecutableVersionOutput(executable string) (string, error) {\n out, err := exec.Command(executable, \"--version\").Output()\n if err != nil {\n return \"\", err\n }\n return string(out), nil\n}\n```\n\n### 3. Workload-controlled path forwarded (Rust \u2014 version_executable)\n\n**File:** `version_executable.rs`\n\n```rust\n// Lines 29-34 \u2014 workload-controlled command_line[0] forwarded to fingerprint\nreturn Some(vec![\n fpr_kind_executable,\n out_dir.to_string(),\n String::from(\u0026process.command_line[0]),\n String::from(\u0026version_executable.runtime_kind_name),\n]);\n```\n\n## Attack Pattern\n\n**Attacker:** Any tenant able to schedule a pod (unprivileged, any namespace)\n**Victim:** The node running the insights-runtime-extractor DaemonSet\n**Trigger:** Automatic \u2014 the DaemonSet scans all container processes on the node\n\n**Attack sequence:**\n\n1. Attacker creates a pod whose process name matches a configured\n versioned-executable pattern (`node`, `python`, `python3`, `MainThread`,\n or contains `java`)\n2. The pod\u0027s main binary (at the path matching argv[0]) is a malicious\n executable that calls `setuid(0)` to restore root\n3. When the insights operator triggers a scan, the DaemonSet forks, enters the\n attacker\u0027s mount namespace, and executes the attacker\u0027s binary with ruid=0\n4. The attacker\u0027s code regains full root with `CAP_SYS_ADMIN` in the host user\n namespace\n5. The inherited cwd contains the host CRI-O socket \u2192 full node compromise"
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "Execution with Unnecessary Privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T13:02:45.076Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2026:83702",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:83702"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-104795"
},
{
"name": "RHBZ#2543917",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543917"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-30T12:50:08.063Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-10-14T09:47:53.272Z",
"value": "Made public."
}
],
"title": "Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution",
"workarounds": [
{
"lang": "en",
"value": "The vulnerability requires a\ncode fix to implement a complete privilege drop (setting all three UID/GID\nfields, clearing all Linux capability sets, and setting `PR_SET_NO_NEW_PRIVS`)\nbefore executing any fingerprint binary."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-250: Execution with Unnecessary Privileges"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-104795",
"datePublished": "2026-10-14T10:55:17.144Z",
"dateReserved": "2026-10-02T13:07:13.820Z",
"dateUpdated": "2026-10-20T13:02:45.076Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-104795\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-14T15:25:50.103511Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-14T15:26:49.725Z\"}}], \"cna\": {\"title\": \"Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:openshift:4.21::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.21\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1792008935\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift4/insights-runtime-extractor-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-09-30T12:50:08.063Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-10-14T09:47:53.272Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2026-10-14T09:47:53.272Z\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHSA-2026:83702\", \"name\": \"RHSA-2026:83702\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2026-104795\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2543917\", \"name\": \"RHBZ#2543917\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"The vulnerability requires a\\ncode fix to implement a complete privilege drop (setting all three UID/GID\\nfields, clearing all Linux capability sets, and setting `PR_SET_NO_NEW_PRIVS`)\\nbefore executing any fingerprint binary.\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`)\\nthat scans container processes for runtime fingerprinting. When scanning a\\ncontainer, the coordinator:\\n\\n1. **fork()s** a child process\\n2. **setns()** into the target container\u0027s PID and mount namespaces\\n3. **fchdir()** back to an orphaned FD pointing at the extractor\u0027s own root\\n filesystem (where `/crio.sock` is hostPath-mounted)\\n4. Calls **only `seteuid(target_uid)`** \\u2014 changing the effective UID but leaving\\n the **real UID and saved-set-UID at 0** and **retaining the permitted\\n capability set**\\n5. The `check_no_privileged_perms()` guard inspects only the Effective capability\\n set (so it passes), and is **skipped entirely when the target runs as uid 0**\\n6. The `VersionExecutable` fingerprint invokes `fpr_kind_executable` with\\n `process.command_line[0]` \\u2014 the target\u0027s argv[0], read from\\n `/proc/\u003cpid\u003e/cmdline` and **fully controlled by the workload**\\n7. `fpr_kind_executable` calls `exec.Command(executable, \\\"--version\\\").Output()`\\n \\u2014 executing the **workload\u0027s own binary** inside the workload\u0027s mount\\n namespace while **ruid=0 in the host user namespace**\\n\\nThe executed process can call `setuid(0)` to restore full root with\\n`CAP_SYS_ADMIN`, and inherits the orphaned cwd which resolves into the extractor\\ncontainer\u0027s filesystem containing the host CRI-O socket.\\n\\n## Affected Code\\n\\n### 1. Insufficient privilege drop (Rust \\u2014 extractor coordinator)\\n\\n**File:** `extractor/src/insights_runtime_extractor.rs`\\n\\n```rust\\n// Lines 139-146 \\u2014 seteuid-only drop, guard skipped for root containers\\njoin_process_namespaces(process.pid)?;\\nchange_dir(current_dir);\\nswitch_user(*process.uid)?;\\nif *process.uid != 0 {\\n perms::check_no_privileged_perms()\\n .expect(\\\"Must not have privileged permissions to run fingerprints\\\");\\n}\\nfingerprint::run_fingerprints(\u0026config, out_dir, \u0026process);\\n```\\n\\n```rust\\n// Lines 182-185 \\u2014 only effective UID changed; ruid/suid stay 0\\nfn switch_user(uid: u32) -\u003e Result\u003c(), ScannerError\u003e {\\n debug!(\\\"... Becoming user: {uid}\\\");\\n seteuid(uid.into()).map_err(|e| ScannerError::Errno(e))\\n}\\n```\\n\\n### 2. Execution of untrusted binary (Go \\u2014 fingerprint)\\n\\n**File:** `fingerprints/pkg/utils/file.go`\\n\\n```go\\n// Lines 75-80 \\u2014 executes a path taken verbatim from workload\u0027s argv[0]\\nfunc GetExecutableVersionOutput(executable string) (string, error) {\\n out, err := exec.Command(executable, \\\"--version\\\").Output()\\n if err != nil {\\n return \\\"\\\", err\\n }\\n return string(out), nil\\n}\\n```\\n\\n### 3. Workload-controlled path forwarded (Rust \\u2014 version_executable)\\n\\n**File:** `version_executable.rs`\\n\\n```rust\\n// Lines 29-34 \\u2014 workload-controlled command_line[0] forwarded to fingerprint\\nreturn Some(vec![\\n fpr_kind_executable,\\n out_dir.to_string(),\\n String::from(\u0026process.command_line[0]),\\n String::from(\u0026version_executable.runtime_kind_name),\\n]);\\n```\\n\\n## Attack Pattern\\n\\n**Attacker:** Any tenant able to schedule a pod (unprivileged, any namespace)\\n**Victim:** The node running the insights-runtime-extractor DaemonSet\\n**Trigger:** Automatic \\u2014 the DaemonSet scans all container processes on the node\\n\\n**Attack sequence:**\\n\\n1. Attacker creates a pod whose process name matches a configured\\n versioned-executable pattern (`node`, `python`, `python3`, `MainThread`,\\n or contains `java`)\\n2. The pod\u0027s main binary (at the path matching argv[0]) is a malicious\\n executable that calls `setuid(0)` to restore root\\n3. When the insights operator triggers a scan, the DaemonSet forks, enters the\\n attacker\u0027s mount namespace, and executes the attacker\u0027s binary with ruid=0\\n4. The attacker\u0027s code regains full root with `CAP_SYS_ADMIN` in the host user\\n namespace\\n5. The inherited cwd contains the host CRI-O socket \\u2192 full node compromise\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-250\", \"description\": \"Execution with Unnecessary Privileges\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-10-20T13:02:45.076Z\"}, \"x_redhatCweChain\": \"CWE-250: Execution with Unnecessary Privileges\"}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-104795\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-20T13:02:45.076Z\", \"dateReserved\": \"2026-10-02T13:07:13.820Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2026-10-14T10:55:17.144Z\", \"assignerShortName\": \"redhat\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…