The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans...
Summary
Vulnerability reported (CVE-2026-104795). Successful exploitation can lead to full system takeover. Exploitable via VersionExecutable.
Original description
The description as published by the source.
The insights-runtime-extractor runs as a privileged DaemonSet (hostPID: true)
that scans container processes for runtime fingerprinting. When scanning a
container, the coordinator:
- fork()s a child process
- setns() into the target container's PID and mount namespaces
- fchdir() back to an orphaned FD pointing at the extractor's own root
filesystem (where/crio.sockis hostPath-mounted) - Calls only
seteuid(target_uid)— changing the effective UID but leaving
the real UID and saved-set-UID at 0 and retaining the permitted
capability set - The
check_no_privileged_perms()guard inspects only the Effective capability
set (so it passes), and is skipped entirely when the target runs as uid 0 - The
VersionExecutablefingerprint invokesfpr_kind_executablewith
process.command_line[0]— the target's argv[0], read from
/proc//cmdlineand fully controlled by the workload fpr_kind_executablecallsexec.Command(executable, "--version").Output()
— executing the workload's own binary inside the workload's mount
namespace while ruid=0 in the host user namespace
The executed process can call setuid(0) to restore full root with
CAP_SYS_ADMIN, and inherits the orphaned cwd which resolves into the extractor
container's filesystem containing the host CRI-O socket.
Affected Code
1. Insufficient privilege drop (Rust — extractor coordinator)
File: `extractor/src/insights_runtime_extrac…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-104795 has been found.
Attackers can target a specific entry point like VersionExecutable over the network to misuse the product.
Successful exploitation can lead to full system takeover. CVSS score: 8.8/10.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "CVE-2026-104795" on the vendor's site.
CVE-2026-104795 — CWE-250 / CVSS v3 8.8
Attack vector: local / no user interaction
Attack surface: VersionExecutable / fpr_kind_executable / CAP_SYS_ADMIN / version_executable.rs
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-250) has been reported. Attackers reach the vulnerable code path via VersionExecutable.
Check the vendor advisory for the affected versions. Attack surface: VersionExecutable / fpr_kind_executable / CAP_SYS_ADMIN / version_executable.rs.
Severity: High (CVSS 8.8/10). Successful exploitation can lead to full system takeover.
Update to the patched release per vendor advisory.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
Audit SBOM/dependencies for affected components.資産台帳・SBOM・依存マニフェストで影響コンポーネントを特定する。
-
2Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
References
- web secalert@redhat.com
- web secalert@redhat.com
- web nvd.nist.gov
- web github.com