{"metadata": {"vulnerability": "CVE-2026-104795", "count": 43, "kinds": {"milestone": 5, "sighting": 1, "kev": 0, "other": 37}}, "data": [{"timestamp": "2026-04-06T16:22:45.353Z", "date_only": false, "value": "2026-04-06T16:22:45.353000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "vulnerabilities.3.release_date"}, {"timestamp": "2026-04-06T17:01:34.639Z", "date_only": false, "value": "2026-04-06T17:01:34.639203+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "vulnerabilities.3.discovery_date"}, {"timestamp": "2026-05-07T19:41:17.631Z", "date_only": false, "value": "2026-05-07T19:41:17.631000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "vulnerabilities.2.release_date"}, {"timestamp": "2026-05-07T20:01:11.324Z", "date_only": false, "value": "2026-05-07T20:01:11.324941+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "vulnerabilities.2.discovery_date"}, {"timestamp": "2026-05-21T00:00:00Z", "date_only": false, "value": "2026-05-21T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "vulnerabilities.6.discovery_date"}, {"timestamp": "2026-05-22T02:31:26.754Z", "date_only": false, "value": "2026-05-22T02:31:26.754000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "vulnerabilities.5.release_date"}, {"timestamp": "2026-05-22T04:01:21.721Z", "date_only": false, "value": "2026-05-22T04:01:21.721980+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "vulnerabilities.5.discovery_date"}, {"timestamp": "2026-05-22T15:01:21.649Z", "date_only": false, "value": "2026-05-22T15:01:21.649000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "vulnerabilities.4.release_date"}, {"timestamp": "2026-05-22T15:01:21.975Z", "date_only": false, "value": "2026-05-22T15:01:21.975000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-05-22T15:01:22.111Z", "date_only": false, "value": "2026-05-22T15:01:22.111000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "vulnerabilities.1.release_date"}, {"timestamp": "2026-05-22T16:00:56.609Z", "date_only": false, "value": "2026-05-22T16:00:56.609820+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "vulnerabilities.1.discovery_date"}, {"timestamp": "2026-05-22T16:01:08.177Z", "date_only": false, "value": "2026-05-22T16:01:08.177603+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2026-05-22T16:01:11.151Z", "date_only": false, "value": "2026-05-22T16:01:11.151484+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "vulnerabilities.4.discovery_date"}, {"timestamp": "2026-06-09T00:00:00Z", "date_only": false, "value": "2026-06-09T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "vulnerabilities.8.discovery_date"}, {"timestamp": "2026-09-02T20:09:51.415Z", "date_only": false, "value": "2026-09-02T20:09:51.415000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "vulnerabilities.7.release_date"}, {"timestamp": "2026-09-02T20:21:15.599Z", "date_only": false, "value": "2026-09-02T20:21:15.599288+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "vulnerabilities.7.discovery_date"}, {"timestamp": "2026-09-30T12:50:08.063Z", "date_only": false, "value": "2026-09-30T12:50:08.063000+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "vulnerabilities.9.discovery_date"}, {"timestamp": "2026-09-30T12:50:08.063Z", "date_only": false, "value": "2026-09-30T12:50:08.063Z", "kind": "other", "label": "Time", "source": "cvelistv5 / redhat", "record": "CVE-2026-104795", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-02T13:07:13.820Z", "date_only": false, "value": "2026-10-02T13:07:13.820Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-104795", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-08T13:27:52.755Z", "date_only": false, "value": "2026-10-08T13:27:52.755000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "vulnerabilities.8.release_date"}, {"timestamp": "2026-10-12T15:36:20.644Z", "date_only": false, "value": "2026-10-12T15:36:20.644000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "vulnerabilities.6.release_date"}, {"timestamp": "2026-10-14T09:47:53.272Z", "date_only": false, "value": "2026-10-14T09:47:53.272Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / redhat", "record": "CVE-2026-104795", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-14T09:47:53.272Z", "date_only": false, "value": "2026-10-14T09:47:53.272000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "vulnerabilities.9.release_date"}, {"timestamp": "2026-10-14T09:47:53.272Z", "date_only": false, "value": "2026-10-14T09:47:53.272Z", "kind": "other", "label": "Time", "source": "cvelistv5 / redhat", "record": "CVE-2026-104795", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-14T10:55:17.144Z", "date_only": false, "value": "2026-10-14T10:55:17.144Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104795", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T11:16:59Z", "date_only": false, "value": "2026-10-14T11:16:59Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-98F3-7G2J-289Q", "record": "GHSA-98F3-7G2J-289Q", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T11:16:59.937Z", "date_only": false, "value": "2026-10-14T11:16:59.937", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104795", "record": "FKIE_CVE-2026-104795", "field": "published"}, {"timestamp": "2026-10-14T12:31:33Z", "date_only": false, "value": "2026-10-14T12:31:33Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-98F3-7G2J-289Q", "record": "GHSA-98F3-7G2J-289Q", "field": "published"}, {"timestamp": "2026-10-14T15:25:50.103Z", "date_only": false, "value": "2026-10-14T15:25:50.103511Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104795", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T15:25:50.103Z", "date_only": false, "value": "2026-10-14T15:25:50.103511Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104795", "record": "FKIE_CVE-2026-104795", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T15:26:53.109Z", "date_only": false, "value": "2026-10-14T15:26:53.109Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104795", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T18:03:12.117Z", "date_only": false, "value": "2026-10-14T18:03:12.117822Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440576987051247", "record": "CVE-2026-104795", "field": "creation_timestamp", "uuid": "b4c9366d-1a26-4798-8052-513ccb8683ab", "content": "CVE-2026-104795 Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`)that scans container processes for runtime fingerprinting. When scanning acontainer, the coordinator:\n1. **fork()s** a child process2. **setns()** into the target container's PID and mount namespaces3. **fchdir()** back to an orphaned FD pointing at the extractor's own root   filesystem (where `/crio.sock` is hostPath-mounted)4. Calls **only `seteuid(target_uid)`** \u2014 changing the effective UID but leaving   the **real UID and saved-set-UID at 0** and **retaining the permitted   capability set**5. The `check_no_privileged_perms()` guard inspects only the Effective capability   set (so it passes), and is **skipped entirely when the target runs as uid 0**6. The `VersionExecutable` fingerprint invokes `fpr_kind_executable` with   `process.command_line[0]` \u2014 the target's argv[0], read from   `/proc/<pid>/cmdline` and **fully controlled by the workload**7. `fpr_kind_executable` calls `exec.Command(executable, \"--version\").Output()`   \u2014 executing the **workload's own binary** inside the workload's mount   namespace while **ruid=0 in the host user namespace**\nThe executed process can call `setuid(0)` to restore full root with`CAP_SYS_ADMIN`, and inherits the orphaned cwd which resolves into the extractorcontainer's filesystem containing the host CRI-O socket.\n## Affected Code\n### 1. Insufficient privilege drop (Rust \u2014 extractor coordinator)\n**File:** `extractor/src/insights_runtime_extractor.rs`\n```rust// Lines 139-146 \u2014 seteuid-only drop, guard skipped for root containersjoin_process_namespaces(process.pid)?;change_dir(current_dir);switch_user(*process.uid)?;if *process.uid != 0 {    perms::check_no_privileged_perms()        .expect(\"Must not have privileged permissions to run fingerprints\");}fingerprint::run_fingerprints(&config, out_dir, &process);```\n```rust// Lines 182-185 \u2014 only effective UID changed; ruid/suid stay 0fn switch_user(uid: u32) -> Result<(), ScannerError> {    debug!(\"... Becoming user: {uid}\");    seteuid(uid.into()).map_err(|e| ScannerError::Errno(e))}```\n### 2. Execution of untrusted binary (Go \u2014 fingerprint)\n**File:** `fingerprints/pkg/utils/file.go`\n```go// Lines 75-80 \u2014 executes a path taken verbatim from workload's argv[0]func GetExecutableVersionOutput(executable string) (string, error) {    out, err := exec.Command(executable, \"--version\").Output()    if err != nil {        return \"\", err    }    return string(out), nil}```\n### 3. Workload-controlled path forwarded (Rust \u2014 version_executable)\n**File:** `version_executable.rs`\n```rust// Lines 29-34 \u2014 workload-controlled command_line[0] forwarded to fingerprintreturn Some(vec![    fpr_kind_executable,    out_dir.to_string(),    String::from(&process.command_line[0]),    String::from(&version_executable.runtime_kind_name),]);```\n## Attack Pattern\n**Attacker:** Any tenant able to schedule a pod (unprivileged, any namespace)**Victim:** The node running the insights-runtime-extractor DaemonSet**Trigger:** Automatic \u2014 the DaemonSet scans all container processes on the node\n**Attack sequence:**\n1. Attacker creates a pod whose process name matches a configured   versioned-executable pattern (`node`, `python`, `python3`, `MainThread`,   or contains `java`)2. The pod's main binary (at the path matching argv[0]) is a malicious   executable that calls `setuid(0)` to restore root3. When the insights operator triggers a scan, the DaemonSet forks, enters the   attacker's mount namespace, and executes the attacker's binary with ruid=04. The attacker's code regains full root with `CAP_SYS_ADMIN` in the host user   namespace5. The inherited cwd contains the host CRI-O socket \u2192 full node compromise\nhttps://www.cve.org/CVERecord?id=CVE-2026-104795https://access.redhat.com/security/cve/CVE-2026-104795https://bugzilla.redhat.com/show_bug.cgi?id=2543917#RedHat #RedHatOpenShiftContainerPlatform4#CVE_2026_104795#bot", "url": "https://infosec.exchange/users/cve/statuses/117440576987051247"}, {"timestamp": "2026-10-20T08:28:30Z", "date_only": false, "value": "2026-10-20T08:28:30+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-20T08:28:30Z", "date_only": false, "value": "2026-10-20T08:28:30+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-10-20T08:28:30Z", "date_only": false, "value": "2026-10-20T08:28:30+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-20T08:31:44Z", "date_only": false, "value": "2026-10-20T08:31:44+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-20T13:02:45.076Z", "date_only": false, "value": "2026-10-20T13:02:45.076Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-104795", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-20T13:02:45.076Z", "date_only": false, "value": "2026-10-20T13:02:45.076Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / redhat", "record": "CVE-2026-104795", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-20T13:16:39.303Z", "date_only": false, "value": "2026-10-20T13:16:39.303", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104795", "record": "FKIE_CVE-2026-104795", "field": "lastModified"}, {"timestamp": "2026-10-20T15:31:16Z", "date_only": false, "value": "2026-10-20T15:31:16Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-98F3-7G2J-289Q", "record": "GHSA-98F3-7G2J-289Q", "field": "modified"}, {"timestamp": "2026-10-20T20:12:25Z", "date_only": false, "value": "2026-10-20T20:12:25+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-20T20:12:25Z", "date_only": false, "value": "2026-10-20T20:12:25+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-20T20:12:25Z", "date_only": false, "value": "2026-10-20T20:12:25+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:83702", "record": "RHSA-2026:83702", "field": "document.tracking.current_release_date"}]}