Every CVE Search/ Get API key

CVE-2026-30892

Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation

0.0 NoneFix available

crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the crun exec option -u (--user) is incorrectly parsed. The value 1 is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
None

Exploit likelihood

0.17%Up 0.2 points since Mar 26, 2026
90%50%10%1%

What each source reports

CVE List Score used 0.0

Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation

crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the crun exec option -u (--user) is incorrectly parsed. The value 1 is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.

Record
CVE-2026-30892
CVSS 3.1
0.0 NoneCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Weakness
CWE-269
Updated
2026-11-02
EUVDEUVD-2026-16026 No score

crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the crun exec option -u (--user) is incorrectly parsed. The value 1 is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.

Record
EUVD-2026-16026
Updated
2026-11-02
NVD 0.0

crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the crun exec option -u (--user) is incorrectly parsed. The value 1 is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.

Record
CVE-2026-30892
CVSS 3.1
0.0 NoneCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-269
Updated
2026-11-02
OSVALPINE-CVE-2026-30892 7.8

crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the crun exec option -u (--user) is incorrectly parsed. The value 1 is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.

Record
ALPINE-CVE-2026-30892
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVBELL-CVE-2026-30892 7.8
Record
BELL-CVE-2026-30892
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 0.0

Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation

crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the crun exec option -u (--user) is incorrectly parsed. The value 1 is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.

Record
CVE-2026-30892
CVSS 3.1
0.0 NoneCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Weakness
CWE-269
Updated
2026-11-02
Show 19 moreShow less
OSVDEBIAN-CVE-2026-30892 7.8

crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the crun exec option -u (--user) is incorrectly parsed. The value 1 is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.

Record
DEBIAN-CVE-2026-30892
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:19020 7.8

Red Hat Security Advisory: crun security update

Record
RHSA-2026:19020
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:19178 7.8

Red Hat Security Advisory: crun security update

Record
RHSA-2026:19178
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:28036 7.8

Red Hat Security Advisory: crun security update

Record
RHSA-2026:28036
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:47905 7.8

Red Hat Security Advisory: container-selinux and crun security, bug fix, and enhancement update

Record
RHSA-2026:47905
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:6621 7.8

Red Hat Security Advisory: crun security update

Record
RHSA-2026:6621
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:6622 7.8

Red Hat Security Advisory: crun security update

Record
RHSA-2026:6622
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:19020 7.8

Moderate: crun security update

crun is a OCI runtime

Security Fix(es):

  • crun: crun: Privilege escalation due to incorrect parsing of the --user option (CVE-2026-30892)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:19020
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:19178 7.8

Moderate: crun security update

crun is a OCI runtime

Security Fix(es):

  • crun: crun: Privilege escalation due to incorrect parsing of the --user option (CVE-2026-30892)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:19178
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:6621 7.8

Moderate: crun security update

crun is a OCI runtime

Security Fix(es):

  • crun: crun: Privilege escalation due to incorrect parsing of the --user option (CVE-2026-30892)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:6621
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:6622 7.8

Moderate: crun security update

crun is a OCI runtime

Security Fix(es):

  • crun: crun: Privilege escalation due to incorrect parsing of the --user option (CVE-2026-30892)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:6622
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-30892 0.0

crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the crun exec option -u (--user) is incorrectly parsed. The value 1 is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.

Record
UBUNTU-CVE-2026-30892
CVSS 3.1
0.0 NoneCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:19020 No score

Moderate: crun security update

crun is a OCI runtime

Security Fix(es):

  • crun: crun: Privilege escalation due to incorrect parsing of the --user option (CVE-2026-30892)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:19020
Updated
2026-11-02
OSVALSA-2026:19178 No score

Moderate: crun security update

crun is a OCI runtime

Security Fix(es):

  • crun: crun: Privilege escalation due to incorrect parsing of the --user option (CVE-2026-30892)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:19178
Updated
2026-11-02
OSVALSA-2026:6621 No score

Moderate: crun security update

crun is a OCI runtime

Security Fix(es):

  • crun: crun: Privilege escalation due to incorrect parsing of the --user option (CVE-2026-30892)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:6621
Updated
2026-11-02
OSVALSA-2026:6622 No score

Moderate: crun security update

crun is a OCI runtime

Security Fix(es):

  • crun: crun: Privilege escalation due to incorrect parsing of the --user option (CVE-2026-30892)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:6622
Updated
2026-11-02
OSVAZL-80951 No score

CVE-2026-30892 affecting package crun 1.24-6

crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the crun exec option -u (--user) is incorrectly parsed. The value 1 is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.

Record
AZL-80951
Updated
2026-11-05
OSVCLSA-2026-1776335959 No score

crun: Fix of CVE-2026-30892

  • CVE-2026-30892: fix incorrect parsing of --user option in crun exec
Record
CLSA-2026-1776335959
Updated
2026-11-02
OSVopenSUSE-SU-2026:10524-1 No score

crun-1.27-1.1 on GA media

These are all security issues fixed in the crun-1.27-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10524-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
crun
Alpine:v3.23
 1.19 up to 1.27-r0
1.27-r0
crun
Alpine:v3.24
 1.19 up to 1.27-r0
1.27-r0
crun
AlmaLinux:10
 before 1.27-2.el10_2
1.27-2.el10_2
crun-krun
AlmaLinux:10
 before 1.27-2.el10_2
1.27-2.el10_2
crun
AlmaLinux:9
 before 1.27-1.el9_8
1.27-1.el9_8
crun
AlmaLinux:9
 before 1.27-1.el9_7
1.27-1.el9_7
crun
AlmaLinux:10
 before 1.27-1.el10_1
1.27-1.el10_1
crun
Azure Linux:3
 through 1.24-6 None known
crun
Alpaquita:25
 1.21-r0 up to 1.23.1-r1
1.23.1-r1
crun
Alpaquita:stream
 1.19-r0 up to 1.27-r0
1.27-r0
Show 33 moreShow less
Affected packages
PackageAffectedFixed
crun
TuxCare:AlmaLinux:9.6
 before 1.23.1-2.el9_6.tuxcare.els1
1.23.1-2.el9_6.tuxcare.els1
crun
Debian:13
 All versions, plus listed versions
1.21-11.21-21.21-31.24-11.26-11.27-11.27.1-11.28-1
 None known
crun
Debian:14
 before 1.27-1, plus listed versions
1.21-11.21-21.21-31.24-11.26-1
1.27-1
crun
Red Hat:enterprise_linux:10.2
 before 0:1.27-2.el10_2
0:1.27-2.el10_2
crun-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:1.27-2.el10_2
0:1.27-2.el10_2
crun-debugsource
Red Hat:enterprise_linux:10.2
 before 0:1.27-2.el10_2
0:1.27-2.el10_2
crun-krun
Red Hat:enterprise_linux:10.2
 before 0:1.27-2.el10_2
0:1.27-2.el10_2
crun
Red Hat:enterprise_linux:9::appstream
 before 0:1.27-1.el9_8
0:1.27-1.el9_8
crun-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.27-1.el9_8
0:1.27-1.el9_8
crun-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:1.27-1.el9_8
0:1.27-1.el9_8
crun
Red Hat:rhel_eus:9.6::appstream
 before 0:1.27-1.el9_6
0:1.27-1.el9_6
crun-debuginfo
Red Hat:rhel_eus:9.6::appstream
 before 0:1.27-1.el9_6
0:1.27-1.el9_6
crun-debugsource
Red Hat:rhel_eus:9.6::appstream
 before 0:1.27-1.el9_6
0:1.27-1.el9_6
container-selinux
Red Hat:enterprise_linux_eus:10.0
 before 4:2.246.0-1.el10_0
4:2.246.0-1.el10_0
crun
Red Hat:enterprise_linux_eus:10.0
 before 0:1.27.1-1.el10_0
0:1.27.1-1.el10_0
crun-debuginfo
Red Hat:enterprise_linux_eus:10.0
 before 0:1.27.1-1.el10_0
0:1.27.1-1.el10_0
crun-debugsource
Red Hat:enterprise_linux_eus:10.0
 before 0:1.27.1-1.el10_0
0:1.27.1-1.el10_0
crun
Red Hat:enterprise_linux:9::appstream
 before 0:1.27-1.el9_7
0:1.27-1.el9_7
crun-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.27-1.el9_7
0:1.27-1.el9_7
crun-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:1.27-1.el9_7
0:1.27-1.el9_7
crun
Red Hat:enterprise_linux:10.1
 before 0:1.27-1.el10_1
0:1.27-1.el10_1
crun-debuginfo
Red Hat:enterprise_linux:10.1
 before 0:1.27-1.el10_1
0:1.27-1.el10_1
crun-debugsource
Red Hat:enterprise_linux:10.1
 before 0:1.27-1.el10_1
0:1.27-1.el10_1
crun
Rocky Linux:10
 before 0:1.27-2.el10_2
0:1.27-2.el10_2
crun
Rocky Linux:9
 before 0:1.27-1.el9_7
0:1.27-1.el9_7
crun
Rocky Linux:10
 before 0:1.27-1.el10_1
0:1.27-1.el10_1
crun
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.10.5+dfsg-10.10.6+dfsg-10.11+dfsg-10.12+dfsg-10.12.1+dfsg-1
 None known
crun
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.17+dfsg-10.17+dfsg-1.10.17+dfsg-1.1ubuntu0.1
 None known
crun
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.8.5-11.11-11.11.1-11.12-11.13-11.14-11.14.1-1
 None known
crun
Ubuntu:25.10
 All versions, plus listed versions
1.20-1syncable11.21-1ubuntu2
 None known
crun
Ubuntu:26.10
 All versions, plus listed versions
1.21-1ubuntu3
 None known
crun
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.21-1ubuntu21.21-1ubuntu3
 None known
crun
openSUSE:Tumbleweed
 before 1.27-1.1
1.27-1.1

History

History
RecordedChangedSources
factsOSV
affected, aliases, referencesOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-30892 is a none vulnerability (CVSS 0.0) in Containers Crun, published March 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 5th percentile. Fixed in crun 1.27-r0.

References

Show 32 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open