CVE-2026-104795

1. fork()s a child process
2. setns() into the target container's PID and mount namespaces
3. fchdir() back to an orphaned FD pointing at the extractor's own root filesystem (where /crio.sock is hostPath-mounted)
4. Calls only seteuid(target uid) — changing the effective UID but leaving the real UID and saved-set-UID at 0 and retaining the permitted capability set
5. The check no privileged perms() guard inspects only the Effective capability set (so it passes), and is skipped entirely when the target runs as uid 0
6. The VersionExecutable fingerprint invokes fpr kind executable with process.command line[0] — the target's argv[0], read from /proc/<pid>/cmdline and fully controlled by the workload
7. fpr kind executable calls exec.Command(executable, "--version").Output() — executing the workload's own binary inside the workload's mount namespace while ruid=0 in the host user namespace

Affected Code

1. Insufficient privilege drop (Rust — extractor coordinator)

// Lines 139-146 — seteuid-only drop, guard skipped for root containers
join process namespaces(process.pid)?;
change dir(current dir);
switch user(*process.uid)?;
if *process.uid != 0 {
  perms::check no privileged perms()
    .expect("Must not have privileged permissions to run fingerprints");
}
fingerprint::run fingerprints(&config, out dir, &process);

// Lines 182-185 — only effective UID changed; ruid/suid stay 0
fn switch user(uid: u32) -> Result<(), ScannerError> {
  debug!("... Becoming user: {uid}");
  seteuid(uid.into()).map err(|e| ScannerError::Errno(e))
}

2. Execution of untrusted binary (Go — fingerprint)

// Lines 75-80 — executes a path taken verbatim from workload's argv[0]
func GetExecutableVersionOutput(executable string) (string, error) {
  out, err := exec.Command(executable, "--version").Output()
  if err != nil {
    return "", err
  }
  return string(out), nil
}

3. Workload-controlled path forwarded (Rust — version executable)

// Lines 29-34 — workload-controlled command line[0] forwarded to fingerprint
return Some(vec![
  fpr kind executable,
  out dir.to string(),
  String::from(&process.command line[0]),
  String::from(&version executable.runtime kind name),
]);

Attack Pattern

1. Attacker creates a pod whose process name matches a configured versioned-executable pattern (node, python, python3, MainThread, or contains java)
2. The pod's main binary (at the path matching argv[0]) is a malicious executable that calls setuid(0) to restore root
3. When the insights operator triggers a scan, the DaemonSet forks, enters the attacker's mount namespace, and executes the attacker's binary with ruid=0
4. The attacker's code regains full root with CAP SYS ADMIN in the host user namespace
5. The inherited cwd contains the host CRI-O socket → full node compromise