Medium [CVE-2026-53489] Arbitrary host file read via symlink following in CRI checkpoint restore
This medium-severity Red Hat Linux advisory covers CVE-2026-53489.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Arbitrary host file read via symlink following in CRI checkpoint restore. Red Hat rates this important (CVSS 6.5).
Weakness: CWE-59. Red Hat lists fixing advisory RHSA-2026:15862 with package syft-main-1.46.0-0.1.hum1, grype-main-0.115.0-0.1.hum1, trivy-main-0.69.3-1.2.hum1.
- < 2.3.2
- < 2.2.5
- < 2.1.9
Official advisory · high-confidence parse· fetched 1 month ago·verify at source
- syft-main-1.46.0-0.1.hum1
- grype-main-0.115.0-0.1.hum1
- trivy-main-0.69.3-1.2.hum1
- RHSA-2026:15862
Official advisory · high-confidence parse· fetched 1 month ago·verify at source
Mitigation checklist
- For Red Hat OpenShift and layered products, CRI-O is the supported container runtime, so the vulnerable containerd CRI checkpoint-restore code path is not exercised during normal cluster operation. Customers should nevertheless apply Red Hat product errata as they become available to receive updates for affected operator, must-gather and tooling images that may bundle the containerd Go module. If containerd is deployed as the container runtime with CRI checkpoint/restore enabled, disable checkpoint/restore functionality until a fixed version of containerd can be applied.
Official advisory · high-confidence parse· fetched 1 month ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.