Read the docs
TI-2026-23721 Aliases CVE-2026-30892

Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation

Priority HIGH 67CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 5 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-269.

Summary

crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00165 5th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial crun (containers): 1.27Red Hat: 7 advisoriesRed Hat: 5 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
containerscrun1.19 to before 1.271.27Patch availableCNA
  • crun Vendorcontainers Affected 1.19 to before 1.27 Fixed in 1.27 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:crun_project:crun:*:*:*:*:*:*:*:*1.19 to before 1.27VulnerableCrun Project
  • cpe:2.3:a:crun_project:crun:*:*:*:*:*:*:*:* Versions 1.19 to before 1.27 Vulnerable ·Crun Project

Remediation

  • Fix · CNA crun (containers) Fixed in 1.27

Red Hat 7 advisories

  • RHSA-2026:47905 Released 2026-07-29 · Red Hat rating Moderate
    container-selinux and crun security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) container-selinux-4:2.246.0-1.el10_0, crun-1.27.1-1.el10_0
  • RHSA-2026:34757 Released 2026-07-09 · Red Hat rating Moderate
    OpenShift Container Platform 4.19.37 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 rhcos-aarch64-4.19.9.6.202606302000-0, rhcos-ppc64le-4.19.9.6.202606302000-0, rhcos-s390x-4.19.9.6.202606302000-0 +1
  • RHSA-2026:28036 Released 2026-06-22 · Red Hat rating Moderate
    crun security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) crun-1.27-1.el9_6
Show 4 more Red Hat advisories
  • RHSA-2026:19178 Released 2026-05-19 · Red Hat rating Moderate
    crun security update
    • Red Hat Enterprise Linux AppStream (v. 9) crun-1.27-1.el9_8
  • RHSA-2026:19020 Released 2026-05-19 · Red Hat rating Moderate
    crun security update
    • Red Hat Enterprise Linux AppStream (v. 10) crun-1.27-2.el10_2, crun-krun-1.27-2.el10_2
  • RHSA-2026:6621 Released 2026-04-06 · Red Hat rating Moderate
    crun security update
    • Red Hat Enterprise Linux AppStream (v. 9) crun-1.27-1.el9_7
  • RHSA-2026:6622 Released 2026-04-06 · Red Hat rating Moderate
    crun security update
    • Red Hat Enterprise Linux AppStream (v. 10) crun-1.27-1.el10_1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:19020, RHSA-2026:6622
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:19178, RHSA-2026:6621
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:47905
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:28036
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:34757
Not affected: 2 products
  • Red Hat Enterprise Linux 8
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-30892

References

Exploit 1

Patch 1

Other 1

  • TI-2025-18645 .krun_config.json symlink attack creates or overwrites file on the host in crun CVSS 4.0HIGH 8.5
  • TI-2026-37901 fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC) CVSS 4.0LOW 2.0
  • TI-2026-29788 bubblewrap vulnerable to privilege escalation in setuid mode via ptrace CVSS 4.0HIGH 8.7
  • TI-2024-07805 Containers/aardvark-dns: tcp query handling flaw in aardvark-dns leading to denial of service CVSS 3.1HIGH 7.5
  • TI-2024-08665 Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library CVSS 3.1HIGH 8.2
  • TI-2020-04347 Privilege escalation in setuid mode via user namespaces in Bubblewrap CVSS 3.1HIGH 7.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences