Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env
Priority LOW 35CWE-134Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 11 fixed, 3 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-134 and the CVSS impact.
Summary
A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00183 7th percentileScored 2026-11-07
Fix Partial Red Hat: 11 advisoriesRed Hat: 11 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | 1.25.5-36.rhaos4.12.git2e7f657.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | 1.26.5-32.rhaos4.13.git1088e36.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 1.27.8-22.rhaos4.14.git0633bf1.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | 1.28.11-17.rhaos4.15.git48e6ddb.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | 1.29.13-14.rhaos4.16.git84cfdc6.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — | 1.30.14-13.rhaos4.17.git3a25d98.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | 1.31.13-14.rhaos4.18.gitf2de9ac.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — | 1.32.13-11.rhaos4.19.git089e95c.el9 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — | 1.33.13-5.rhaos4.20.git7ebc848.el9 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | — | 1.34.11-4.rhaos4.21.git358c4b4.el9 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | — | 1.35.6-5.rhaos4.22.git41f610b.el9 | Patch available | CNA |
| Red Hat | Confidential Compute Attestation | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — | No fix listed | CNA |
- Red Hat OpenShift Container Platform 4.12 VendorRed Hat Affected — Fixed in 1.25.5-36.rhaos4.12.git2e7f657.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.13 VendorRed Hat Affected — Fixed in 1.26.5-32.rhaos4.13.git1088e36.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 1.27.8-22.rhaos4.14.git0633bf1.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 1.28.11-17.rhaos4.15.git48e6ddb.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.16 VendorRed Hat Affected — Fixed in 1.29.13-14.rhaos4.16.git84cfdc6.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.17 VendorRed Hat Affected — Fixed in 1.30.14-13.rhaos4.17.git3a25d98.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.18 VendorRed Hat Affected — Fixed in 1.31.13-14.rhaos4.18.gitf2de9ac.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.19 VendorRed Hat Affected — Fixed in 1.32.13-11.rhaos4.19.git089e95c.el9 Patch available CNA
- Red Hat OpenShift Container Platform 4.20 VendorRed Hat Affected — Fixed in 1.33.13-5.rhaos4.20.git7ebc848.el9 Patch available CNA
- Red Hat OpenShift Container Platform 4.21 VendorRed Hat Affected — Fixed in 1.34.11-4.rhaos4.21.git358c4b4.el9 Patch available CNA
- Red Hat OpenShift Container Platform 4.22 VendorRed Hat Affected — Fixed in 1.35.6-5.rhaos4.22.git41f610b.el9 Patch available CNA
- Confidential Compute Attestation VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 5 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE names CNA · 23
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:openshift:4.12::el8 | 4.12 | — | Red Hat |
| cpe:/a:redhat:openshift:4.13::el8 | 4.13 | — | Red Hat |
| cpe:/a:redhat:openshift:4.13::el9 | 4.13 | — | Red Hat |
| cpe:/a:redhat:openshift:4.14::el8 | 4.14 | — | Red Hat |
| cpe:/a:redhat:openshift:4.14::el9 | 4.14 | — | Red Hat |
| cpe:/a:redhat:openshift:4.15::el8 | 4.15 | — | Red Hat |
| cpe:/a:redhat:openshift:4.15::el9 | 4.15 | — | Red Hat |
| cpe:/a:redhat:openshift:4.16::el8 | 4.16 | — | Red Hat |
| cpe:/a:redhat:openshift:4.16::el9 | 4.16 | — | Red Hat |
| cpe:/a:redhat:openshift:4.17::el8 | 4.17 | — | Red Hat |
- cpe:/a:redhat:openshift:4.12::el8 Versions 4.12 — ·Red Hat
- cpe:/a:redhat:openshift:4.13::el8 Versions 4.13 — ·Red Hat
- cpe:/a:redhat:openshift:4.13::el9 Versions 4.13 — ·Red Hat
- cpe:/a:redhat:openshift:4.14::el8 Versions 4.14 — ·Red Hat
- cpe:/a:redhat:openshift:4.14::el9 Versions 4.14 — ·Red Hat
- cpe:/a:redhat:openshift:4.15::el8 Versions 4.15 — ·Red Hat
- cpe:/a:redhat:openshift:4.15::el9 Versions 4.15 — ·Red Hat
- cpe:/a:redhat:openshift:4.16::el8 Versions 4.16 — ·Red Hat
- cpe:/a:redhat:openshift:4.16::el9 Versions 4.16 — ·Red Hat
- cpe:/a:redhat:openshift:4.17::el8 Versions 4.17 — ·Red Hat
Show 13 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:openshift:4.17::el9 | 4.17 | — | Red Hat |
| cpe:/a:redhat:openshift:4.18::el8 | 4.18 | — | Red Hat |
| cpe:/a:redhat:openshift:4.18::el9 | 4.18 | — | Red Hat |
| cpe:/a:redhat:openshift:4.19::el9 | 4.19 | — | Red Hat |
| cpe:/a:redhat:openshift:4.20::el8 | 4.20 | — | Red Hat |
| cpe:/a:redhat:openshift:4.20::el9 | 4.20 | — | Red Hat |
| cpe:/a:redhat:openshift:4.21::el9 | 4.21 | — | Red Hat |
| cpe:/a:redhat:openshift:4.22::el8 | 4.22 | — | Red Hat |
| cpe:/a:redhat:openshift:4.22::el9 | 4.22 | — | Red Hat |
| cpe:/a:redhat:openshift_ironic:4.22::el9 | 4.22 | — | Red Hat |
| cpe:/a:redhat:confidential_compute_attestation:1 | 1 | — | Red Hat |
| cpe:/a:redhat:openshift:4 | 4 | — | Red Hat |
| cpe:/a:redhat:openshift:5 | 5 | — | Red Hat |
- cpe:/a:redhat:openshift:4.17::el9 Versions 4.17 — ·Red Hat
- cpe:/a:redhat:openshift:4.18::el8 Versions 4.18 — ·Red Hat
- cpe:/a:redhat:openshift:4.18::el9 Versions 4.18 — ·Red Hat
- cpe:/a:redhat:openshift:4.19::el9 Versions 4.19 — ·Red Hat
- cpe:/a:redhat:openshift:4.20::el8 Versions 4.20 — ·Red Hat
- cpe:/a:redhat:openshift:4.20::el9 Versions 4.20 — ·Red Hat
- cpe:/a:redhat:openshift:4.21::el9 Versions 4.21 — ·Red Hat
- cpe:/a:redhat:openshift:4.22::el8 Versions 4.22 — ·Red Hat
- cpe:/a:redhat:openshift:4.22::el9 Versions 4.22 — ·Red Hat
- cpe:/a:redhat:openshift_ironic:4.22::el9 Versions 4.22 — ·Red Hat
- cpe:/a:redhat:confidential_compute_attestation:1 Versions 1 — ·Red Hat
- cpe:/a:redhat:openshift:4 Versions 4 — ·Red Hat
- cpe:/a:redhat:openshift:5 Versions 5 — ·Red Hat
Remediation
Red Hat 11 advisories
- RHSA-2026:70585 Released 2026-10-01 · Red Hat rating ImportantOpenShift Container Platform 4.17.58 packages and security update
- Red Hat OpenShift Container Platform 4.17 cri-o-1.30.14-13.rhaos4.17.git3a25d98.el8, cri-o-1.30.14-13.rhaos4.17.git3a25d98.el9, cri-tools-1.30.0-10.el8 +23
- RHSA-2026:67856 Released 2026-09-24 · Red Hat rating ImportantOpenShift Container Platform 4.15.69 packages and security update
- Red Hat OpenShift Container Platform 4.15 cri-o-1.28.11-17.rhaos4.15.git48e6ddb.el8, cri-o-1.28.11-17.rhaos4.15.git48e6ddb.el9
- RHSA-2026:67836 Released 2026-09-24 · Red Hat rating ImportantOpenShift Container Platform 4.14.74 packages and security update
- Red Hat OpenShift Container Platform 4.14 cri-o-1.27.8-22.rhaos4.14.git0633bf1.el8, cri-o-1.27.8-22.rhaos4.14.git0633bf1.el9
Show 8 more Red Hat advisories
- RHSA-2026:66385 Released 2026-09-17 · Red Hat rating ImportantOpenShift Container Platform 4.18.55 packages and security update
- Red Hat OpenShift Container Platform 4.18 cri-o-1.31.13-14.rhaos4.18.gitf2de9ac.el8, cri-o-1.31.13-14.rhaos4.18.gitf2de9ac.el9
- RHSA-2026:65906 Released 2026-09-17 · Red Hat rating ImportantOpenShift Container Platform 4.12.98 packages and security update
- Red Hat OpenShift Container Platform 4.12 cri-o-1.25.5-36.rhaos4.12.git2e7f657.el8
- RHSA-2026:65838 Released 2026-09-17 · Red Hat rating ImportantOpenShift Container Platform 4.13.71 packages and security update
- Red Hat OpenShift Container Platform 4.13 containernetworking-plugins-1:1.4.0-8.rhaos4.13.el8, cri-o-1.26.5-32.rhaos4.13.git1088e36.el8, cri-o-1.26.5-32.rhaos4.13.git1088e36.el9 +14
- RHSA-2026:62548 Released 2026-09-10 · Red Hat rating ImportantOpenShift Container Platform 4.16.70 packages and security update
- Red Hat OpenShift Container Platform 4.16 cri-o-1.29.13-14.rhaos4.16.git84cfdc6.el8, cri-o-1.29.13-14.rhaos4.16.git84cfdc6.el9
- RHSA-2026:60452 Released 2026-09-02 · Red Hat rating ImportantOpenShift Container Platform 4.19.45 packages and security update
- Red Hat OpenShift Container Platform 4.19 cri-o-1.32.13-11.rhaos4.19.git089e95c.el9
- RHSA-2026:60449 Released 2026-09-01 · Red Hat rating ImportantOpenShift Container Platform 4.21.31 packages and security update
- Red Hat OpenShift Container Platform 4.21 cri-o-1.34.11-4.rhaos4.21.git358c4b4.el9
- RHSA-2026:60444 Released 2026-09-01 · Red Hat rating ImportantOpenShift Container Platform 4.20.36 packages and security update
- Red Hat OpenShift Container Platform 4.20 cri-o-1.33.13-5.rhaos4.20.git7ebc848.el9
- RHSA-2026:57361 Released 2026-08-25 · Red Hat rating ImportantOpenShift Container Platform 4.22.11 packages and security update
- Red Hat OpenShift Container Platform 4.22 cri-o-1.35.6-5.rhaos4.22.git41f610b.el9, cri-tools-1.35.0-3.el9, openshift-4.22.0-202608190726.p2.g05744ab.assembly.stream.el8 +17
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Confidential Compute Attestation | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2026:65906 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2026:65838 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2026:67836 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2026:67856 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2026:62548 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2026:70585 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2026:66385 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:60452 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:60444 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:60449 |
| Red Hat OpenShift Container Platform 4.22 | Fixed | RHSA-2026:57361 |
Not affected: 9 products
- Ironic content for Red Hat OpenShift Container Platform 4.22
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Container Platform 4.18
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.22
Timeline
- 2026-10-02 Threatist record created from CVE-2026-15809
- 2026-10-03 Alias added: GHSA-9gq4-2485-q63q
- 2026-11-02 Affected versions changed · CNA
- 2026-11-02 Affected versions changed · Red Hat
References
Advisory 11
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-15809 · CVE Program
- CVE-2026-15809 · NVD
- FIRST EPSS
- GHSA-9gq4-2485-q63q · GitHub Advisory Database · CC BY 4.0
- CVE-2026-15809 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences