{"id":"CVE-2026-84042","aliases":["ALPINE-CVE-2026-84042","BELL-CVE-2026-84042","EUVD-2026-75321","GHSA-ggww-wrxv-mmw2","UBUNTU-CVE-2026-84042","openSUSE-SU-2026:12162-1"],"status":"published","title":"Crun: crun: rootful krun with passt executes container payload as host root","description":"A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun \u003e= 1.29","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00101,"percentile":0.00885,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269"],"published":"2026-09-10T08:24:50Z","modified":"2026-11-11T12:52:51Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"crun","fixed_in":["1.30.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"crun","fixed_in":["1.30.1-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.5-r0"},{"fixed":"1.30.1-r0"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.5+dfsg-1","0.10.6+dfsg-1","0.11+dfsg-1","0.12+dfsg-1","0.12.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17+dfsg-1","0.17+dfsg-1.1","0.17+dfsg-1.1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.5-1","1.11-1","1.11.1-1","1.12-1","1.13-1","1.14-1","1.14.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21-1ubuntu2","1.21-1ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.1-1.1"}]}],"bundled":3}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 5"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:97561","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98561","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84042","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531222","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/containers/crun/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84042"},{"url":"https://github.com/containers/crun"},{"url":"https://github.com/advisories/GHSA-ggww-wrxv-mmw2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-84042","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-84042","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-84042","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84042","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88265","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-84042","title":"Crun: crun: rootful krun with passt executes container payload as host root","description":"A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun \u003e= 1.29","status":"published","published":"2026-09-10T08:24:50.971Z","modified":"2026-11-11T12:52:51.999Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-11T13:28:05.136075Z"}],"euvd":[{"id":"EUVD-2026-75321","description":"A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun \u003e= 1.29","status":"published","published":"2026-09-10T08:24:50Z","modified":"2026-11-11T12:52:51Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T14:28:59.314266Z"}],"ghsa":[{"id":"GHSA-ggww-wrxv-mmw2","title":"A flaw was found in crun. When crun is built with libkrun and a container is started rootful with...","description":"A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun \u003e= 1.29","status":"published","published":"2026-09-10T09:31:34Z","modified":"2026-11-11T15:31:43Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-11T15:34:48.112751Z"}],"nvd":[{"id":"CVE-2026-84042","description":"A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun \u003e= 1.29","status":"published","published":"2026-09-10T09:17:03.26Z","modified":"2026-11-11T13:17:28.043Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-11T15:25:15.031694Z"}],"osv":[{"id":"ALPINE-CVE-2026-84042","description":"A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun \u003e= 1.29","status":"published","published":"2026-09-10T09:17:03.26Z","modified":"2026-11-03T06:33:04.359232937Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"BELL-CVE-2026-84042","status":"published","published":"2026-09-14T06:05:21.238557Z","modified":"2026-10-07T16:14:40.41627Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:26.341144Z"},{"id":"UBUNTU-CVE-2026-84042","description":"A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun \u003e= 1.29","status":"published","published":"2026-09-10T09:17:00Z","modified":"2026-10-17T13:01:12.483899821Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:22.213888Z"},{"id":"openSUSE-SU-2026:12162-1","title":"crun-1.30.1-1.1 on GA media","description":"These are all security issues fixed in the crun-1.30.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-17T00:00:00Z","modified":"2026-10-18T11:15:03.793482292Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}