CVE-2026-104795

/// Technical description

The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`)

that scans container processes for runtime fingerprinting. When scanning a

container, the coordinator:

1. **fork()s** a child process

2. **setns()** into the target container's PID and mount namespaces

3. **fchdir()** back to an orphaned FD pointing at the extractor's own root

filesystem (where `/crio.sock` is hostPath-mounted)

4. Calls **only `seteuid(target_uid)`** — changing the effective UID but leaving

the **real UID and saved-set-UID at 0** and **retaining the permitted

capability set**

5. The `check_no_privileged_perms()` guard inspects only the Effective capability

set (so it passes), and is **skipped entirely when the target runs as uid 0**

6. The `VersionExecutable` fingerprint invokes `fpr_kind_executable` with

`process.command_line[0]` — the target's argv[0], read from

`/proc/<pid>/cmdline` and **fully controlled by the workload**

7. `fpr_kind_executable` calls `exec.Command(e

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References