Vulnerabilities

TI-2026-23721 CVE-2026-30892

Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation

HIGH 67

crun is an open source OCI Container Runtime fully written in C.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00165 Published 2026-03-25 Partial fix · 1.27 CWE-269

TI-2022-10631 CVE-2022-27650

LOW 35

A flaw was found in crun where containers were incorrectly started with non-empty default permissions.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.0124 Published 2022-04-04 Partial fix CWE-276

TI-2019-13573 CVE-2019-18837 · GHSA-992m-xc3g-r7rj

MEDIUM 40

An issue was discovered in crun before 0.10.5.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01418 Published 2019-11-13 Fixed in 0.10.5 CWE-59