CVE-2022-0811: Kubernetes Cri-O

High severity, CVSS 8.8. EPSS: 19% chance of exploitation in the next 30 days.

A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape and arbitrary code execution as root on the cluster node, where the malicious pod was deployed.

Affected products

• Kubernetes Cri-O: from 1.19.0, before 1.19.6 (fixed in 1.19.6); from 1.20.0, before 1.20.7 (fixed in 1.20.7); from 1.21.0, before 1.21.6 (fixed in 1.21.6); from 1.22.0, before 1.22.3 (fixed in 1.22.3); from 1.23.0, before 1.23.2 (fixed in 1.23.2)

Published 2022-03-16. Last modified 2026-06-17.