Skip to content
Fencer Intel
high 8.8

CVE-2026-104795 json

Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution

published 26d ago modified 10d ago also EUVD-2026-100981

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits
0
none known

Summary

The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fingerprinting. When scanning a container, the coordinator:

1. **fork()s** a child process 2. **setns()** into the target container's PID and mount namespaces 3. **fchdir()** back to an orphaned FD pointing at the extractor's own root filesystem (where `/crio.sock` is hostPath-mounted) 4. Calls **only `seteuid(target_uid)`** — changing the effective UID but leaving the **real UID and saved-set-UID at 0** and **retaining the permitted capability set** 5. The `check_no_privileged_perms()` guard inspects only the Effective capability set (so it passes), and is **skipped entirely when the target runs as uid 0** 6. The `VersionExecutable` fingerprint invokes `fpr_kind_executable` with `process.command_line[0]` — the target's argv[0], read from `/proc/<pid>/cmdline` and **fully controlled by the workload** 7. `fpr_kind_executable` calls `exec.Command(executable, "--version").Output()` — executing the **workload's own binary** inside the workload's mount namespace while **ruid=0 in the host user namespace**

The executed process can call `setuid(0)` to restore full root with `CAP_SYS_ADMIN`, and inherits the orphaned cwd which resolves into the extractor container's filesystem containing the host CRI-O socket.

## Affected Code

### 1. Insufficient privilege drop (Rust — extractor coordinator)

**File:** `extractor/src/insights_runtime_extractor.rs`

```rust // Lines 139-146 — seteuid-only drop, guard skipped for root containers join_process_namespaces(process.pid)?; change_dir(current_dir); switch_user(*process.uid)?; if *process.uid != 0 { perms::check_no_privileged_perms() .expect("Must not have privileged permissions to run fingerprints"); } fingerprint::run_fingerprints(&config, out_dir, &process); ```

```rust // Lines 182-185 — only effective UID changed; ruid/suid stay 0 fn switch_user(uid: u32) -> Result<(), ScannerError> { debug!("... Becoming user: {uid}"); seteuid(uid.into()).map_err(|e| ScannerError::Errno(e)) } ```

### 2. Execution of untrusted binary (Go — fingerprint)

**File:** `fingerprints/pkg/utils/file.go`

```go // Lines 75-80 — executes a path taken verbatim from workload's argv[0] func GetExecutableVersionOutput(executable string) (string, error) { out, err := exec.Command(executable, "--version").Output() if err != nil { return "", err } return string(out), nil } ```

### 3. Workload-controlled path forwarded (Rust — version_executable)

**File:** `version_executable.rs`

```rust // Lines 29-34 — workload-controlled command_line[0] forwarded to fingerprint return Some(vec![ fpr_kind_executable, out_dir.to_string(), String::from(&process.command_line[0]), String::from(&version_executable.runtime_kind_name), ]); ```

## Attack Pattern

**Attacker:** Any tenant able to schedule a pod (unprivileged, any namespace) **Victim:** The node running the insights-runtime-extractor DaemonSet **Trigger:** Automatic — the DaemonSet scans all container processes on the node

**Attack sequence:**

1. Attacker creates a pod whose process name matches a configured versioned-executable pattern (`node`, `python`, `python3`, `MainThread`, or contains `java`) 2. The pod's main binary (at the path matching argv[0]) is a malicious executable that calls `setuid(0)` to restore root 3. When the insights operator triggers a scan, the DaemonSet forks, enters the attacker's mount namespace, and executes the attacker's binary with ruid=0 4. The attacker's code regains full root with `CAP_SYS_ADMIN` in the host user namespace 5. The inherited cwd contains the host CRI-O socket → full node compromise

Patch / fix

  • Red Hat Red Hat OpenShift Container Platform 4.19 1792771524
  • Red Hat Red Hat OpenShift Container Platform 4.20 1792849665
  • Red Hat Red Hat OpenShift Container Platform 4.21 1792008935
  • Red Hat Red Hat OpenShift Container Platform 4.22 1792844435

Is CVE-2026-104795 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-104795 updated cvss 8.8

insights-runtime-extractor: insights-runtime-extractor: Container Escape via Privileged Binary Execution

  • Red Hat OpenShift Container Platform 5 openshift5/insights-runtime-extractor-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4.19 openshift4/insights-runtime-extractor-rhel9 1792771524
    fixed: vendor fix RHSA-2026:89655
  • Red Hat OpenShift Container Platform 4.20 openshift4/insights-runtime-extractor-rhel9 1792849665
    fixed: vendor fix RHSA-2026:89341
  • Red Hat OpenShift Container Platform 4.21 openshift4/insights-runtime-extractor-rhel9 1792008935
    fixed: vendor fix RHSA-2026:83702
  • Red Hat OpenShift Container Platform 4.22 openshift4/insights-runtime-extractor-rhel9 1792844435
    fixed: vendor fix RHSA-2026:89198
  • Red Hat OpenShift Container Platform 4.19 openshift4/frr-rhel9 1792851377, openshift4/ose-cli-rhel9 1792851458, openshift4/ose-pod-rhel9 1792824706, openshift4/ose-etcd-rhel9 1792773708, openshift4/ose-tests-rhel9 1792855702, openshift4/ose-tools-rhel9 1792851485, +180 more Red Hat OpenShift Container Platform 4.20 openshift4/frr-rhel9 1792849940, openshift4/ose-cli-rhel9 1792849481, openshift4/ose-pod-rhel9 1792825995, openshift4/ose-etcd-rhel9 1792825148, openshift4/ose-tests-rhel9 1792851596, openshift4/ose-tools-rhel9 1792849604, +182 more Red Hat OpenShift Container Platform 4.21 openshift4/frr-rhel9 1792074776, openshift4/ose-cli-rhel9 1791978373, openshift4/ose-pod-rhel9 1791994367, openshift4/ose-etcd-rhel9 1791978549, openshift4/ose-tests-rhel9 1791991134, openshift4/ose-tools-rhel9 1791978846, +181 more Red Hat OpenShift Container Platform 4.22 openshift4/frr-rhel9 1792844305, openshift4/ose-cli-rhel9 1792854321, openshift4/ose-pod-rhel9 1792855800, openshift4/ose-etcd-rhel9 1792769386, openshift4/ose-tests-rhel9 1792844569, openshift4/ose-tools-rhel9 1792769417, +182 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
26d ago

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenShift Container Platform 4.22
  • Red Hat Red Hat OpenShift Container Platform 5

Classification

Weakness
  • CWE-250 Execution with Unnecessary Privileges

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.