A security issue was found in CRI-O’s bind_mount_prefix handling where it is configured with non-empty bind_mount_prefix, a CRI hostPath containing an intermediate absolute symlink may cause the eventual bind mount source to resolve outside the inteneded prefixed root. bind_mount_prefix is used in deployments where CRI-O itself runs in a container and the real host root is mounted under a prefix such as /host. In this If kubernetes/CRI requests CRI-O to mount /var/lib/example it will mount /host/var/lib/example. The exploitation requires that the resulting path contains an intermediate absolute symlink.