{"id":"CVE-2026-30892","aliases":["ALPINE-CVE-2026-30892","ALSA-2026:19020","ALSA-2026:19178","ALSA-2026:6621","ALSA-2026:6622","AZL-80951","BELL-CVE-2026-30892","CLSA-2026-1776335959","DEBIAN-CVE-2026-30892","EUVD-2026-16026","GHSA-4vg2-xjqj-7chj","RHSA-2026:19020","RHSA-2026:19178","RHSA-2026:28036","RHSA-2026:47905","RHSA-2026:6621","RHSA-2026:6622","RLSA-2026:19020","RLSA-2026:19178","RLSA-2026:6621","RLSA-2026:6622","UBUNTU-CVE-2026-30892","openSUSE-SU-2026:10524-1"],"status":"published","title":"Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation","description":"crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the  `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and  GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.","severity":{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00165,"percentile":0.0577,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269"],"published":"2026-03-25T23:57:01Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"crun","fixed_in":["1.27-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"crun","fixed_in":["1.27-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"crun","fixed_in":["1.27-2.el10_2","1.27-1.el10_1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"crun-krun","fixed_in":["1.27-2.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"crun","fixed_in":["1.27-1.el9_8","1.27-1.el9_7"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"crun","fixed_in":["1.23.1-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"crun","fixed_in":["1.27-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"crun","fixed_in":["1.23.1-2.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"crun","fixed_in":["1.27-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"crun","fixed_in":["0:1.27-2.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"crun-debuginfo","fixed_in":["0:1.27-2.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"crun-debugsource","fixed_in":["0:1.27-2.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"crun-krun","fixed_in":["0:1.27-2.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"crun","fixed_in":["0:1.27-1.el9_8","0:1.27-1.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"crun-debuginfo","fixed_in":["0:1.27-1.el9_8","0:1.27-1.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"crun-debugsource","fixed_in":["0:1.27-1.el9_8","0:1.27-1.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"crun","fixed_in":["0:1.27-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"crun-debuginfo","fixed_in":["0:1.27-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"crun-debugsource","fixed_in":["0:1.27-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"container-selinux","fixed_in":["4:2.246.0-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"crun","fixed_in":["0:1.27.1-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"crun-debuginfo","fixed_in":["0:1.27.1-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"crun-debugsource","fixed_in":["0:1.27.1-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"crun","fixed_in":["0:1.27-1.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"crun-debuginfo","fixed_in":["0:1.27-1.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"crun-debugsource","fixed_in":["0:1.27-1.el10_1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"crun","fixed_in":["0:1.27-2.el10_2","0:1.27-1.el10_1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"crun","fixed_in":["0:1.27-1.el9_7"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"crun","fixed_in":["1.27-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19"},{"fixed":"1.27-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19"},{"fixed":"1.27-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27-2.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"crun-krun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27-2.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27-1.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27-1.el9_7"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27-1.el10_1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.24-6"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.21-r0"},{"fixed":"1.23.1-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19-r0"},{"fixed":"1.27-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-2.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21-1","1.21-2","1.21-3","1.24-1","1.26-1","1.27-1","1.27.1-1","1.28-1"]},{"source":"osv","ecosystem":"Debian:14","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27-1"}]}],"versions":["1.21-1","1.21-2","1.21-3","1.24-1","1.26-1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27-2.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"crun-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27-2.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"crun-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27-2.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"crun-krun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27-2.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"crun-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"crun-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"crun-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"crun-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"container-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:2.246.0-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.1-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"crun-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.1-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"crun-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.1-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27-1.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"crun-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27-1.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"crun-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27-1.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27-1.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"crun-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27-1.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"crun-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27-1.el10_1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27-2.el10_2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27-1.el9_7"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27-1.el9_7"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27-1.el10_1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.5+dfsg-1","0.10.6+dfsg-1","0.11+dfsg-1","0.12+dfsg-1","0.12.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17+dfsg-1","0.17+dfsg-1.1","0.17+dfsg-1.1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.5-1","1.11-1","1.11.1-1","1.12-1","1.13-1","1.14-1","1.14.1-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20-1syncable1","1.21-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21-1ubuntu2","1.21-1ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27-1.1"}]}]}],"products":[{"vendor":"containers","product":"crun"},{"vendor":"crun_project","product":"crun"}],"references":[{"url":"https://github.com/containers/crun/security/advisories/GHSA-4vg2-xjqj-7chj","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/containers/crun/commit/1bd7f42446999b0e76bc3d575392e05c943b0b01","tags":["x_refsource_MISC","Patch","fix","article","report"]},{"url":"https://github.com/containers/crun/releases/tag/1.27","tags":["x_refsource_MISC","Product","web","article","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-30892","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19020","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-30892","tags":["report"]},{"url":"https://bugzilla.redhat.com/2451576","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-19020.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19178","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-19178.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6621","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-6621.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6622","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-6622.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30892","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-30892","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1776335959.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30892.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-30892","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451576","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-161090","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19020.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-30892","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19178.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28036","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_28036.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47905","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-210644","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47905.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6621.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6622.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:19020","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:19178","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:6621","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:6622","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-30892","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30892","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-30892","title":"Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation","description":"crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the  `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and  GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.","status":"published","published":"2026-03-25T23:57:01.741Z","modified":"2026-03-26T18:10:16.318Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T13:44:07.200604Z"}],"euvd":[{"id":"EUVD-2026-16026","description":"crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the  `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and  GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.","status":"published","published":"2026-03-25T23:57:01Z","modified":"2026-03-26T18:10:16Z","updated_at":"2026-11-02T19:25:28.18595Z"}],"nvd":[{"id":"CVE-2026-30892","description":"crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the  `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and  GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.","status":"published","published":"2026-03-26T00:16:38.953Z","modified":"2026-06-17T10:33:06.19Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:12:11.678711Z"}],"osv":[{"id":"ALPINE-CVE-2026-30892","description":"crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the  `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and  GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.","status":"published","published":"2026-03-26T00:16:38.953Z","modified":"2026-11-03T06:32:53.83153441Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"BELL-CVE-2026-30892","status":"published","published":"2026-03-27T09:44:03.698421Z","modified":"2026-06-10T07:15:05.512177334Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.315185Z"},{"id":"CVE-2026-30892","title":"Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation","description":"crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the  `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and  GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.","status":"published","published":"2026-03-25T23:57:01.741Z","modified":"2026-10-28T11:10:10.238407567Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:45:00.861953Z"},{"id":"DEBIAN-CVE-2026-30892","description":"crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the  `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and  GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.","status":"published","published":"2026-03-26T00:16:38.953Z","modified":"2026-10-01T03:02:34.743464668Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"RHSA-2026:19020","title":"Red Hat Security Advisory: crun security update","status":"published","published":"2026-05-20T10:09:36Z","modified":"2026-10-03T10:06:26Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:19178","title":"Red Hat Security Advisory: crun security update","status":"published","published":"2026-05-20T10:10:12Z","modified":"2026-10-03T10:06:43Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:28036","title":"Red Hat Security Advisory: crun security update","status":"published","published":"2026-06-23T10:08:17Z","modified":"2026-10-03T10:09:05Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:47905","title":"Red Hat Security Advisory: container-selinux and crun security, bug fix, and enhancement update","status":"published","published":"2026-07-30T10:17:52Z","modified":"2026-10-03T10:11:59Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:6621","title":"Red Hat Security Advisory: crun security update","status":"published","published":"2026-04-06T10:06:38Z","modified":"2026-10-03T10:14:49Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:6622","title":"Red Hat Security Advisory: crun security update","status":"published","published":"2026-04-06T10:06:39Z","modified":"2026-10-03T10:14:50Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RLSA-2026:19020","title":"Moderate: crun security update","description":"crun is a OCI runtime\n\nSecurity Fix(es):\n\n* crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-29T16:03:24.060458Z","modified":"2026-05-29T16:30:25.590479308Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2026:19178","title":"Moderate: crun security update","description":"crun is a OCI runtime\n\nSecurity Fix(es):\n\n* crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-20T00:03:50.188648Z","modified":"2026-05-20T00:30:08.874457942Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:6621","title":"Moderate: crun security update","description":"crun is a OCI runtime\n\nSecurity Fix(es):\n\n* crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-08T06:01:52.863918Z","modified":"2026-04-08T06:30:06.663109Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:6622","title":"Moderate: crun security update","description":"crun is a OCI runtime\n\nSecurity Fix(es):\n\n* crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-09T12:07:05.48411Z","modified":"2026-04-09T12:30:18.146353Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-30892","description":"crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the  `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and  GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.","status":"published","published":"2026-03-26T00:16:00Z","modified":"2026-10-17T12:58:08.35302095Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:11.640778Z"},{"id":"ALSA-2026:19020","title":"Moderate: crun security update","description":"crun is a OCI runtime  \n\nSecurity Fix(es):  \n\n  * crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-19T00:00:00Z","modified":"2026-10-29T11:30:17.570264813Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:19178","title":"Moderate: crun security update","description":"crun is a OCI runtime  \n\nSecurity Fix(es):  \n\n  * crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-19T00:00:00Z","modified":"2026-10-29T11:32:31.062081837Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:6621","title":"Moderate: crun security update","description":"crun is a OCI runtime  \n\nSecurity Fix(es):  \n\n  * crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-06T00:00:00Z","modified":"2026-10-29T11:31:33.414391907Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:6622","title":"Moderate: crun security update","description":"crun is a OCI runtime  \n\nSecurity Fix(es):  \n\n  * crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-06T00:00:00Z","modified":"2026-10-29T11:58:14.066406Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-80951","title":"CVE-2026-30892 affecting package crun 1.24-6","description":"crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the  `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and  GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.","status":"published","published":"2026-03-26T00:16:38Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"CLSA-2026-1776335959","title":"crun: Fix of CVE-2026-30892","description":"- CVE-2026-30892: fix incorrect parsing of --user option\n  in crun exec","status":"published","published":"2026-04-16T10:39:25Z","modified":"2026-06-01T00:32:47.89129989Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"openSUSE-SU-2026:10524-1","title":"crun-1.27-1.1 on GA media","description":"These are all security issues fixed in the crun-1.27-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-10T00:00:00Z","modified":"2026-04-11T08:01:04.283119Z","updated_at":"2026-11-02T16:58:38.415593Z"}]}}