Every CVESearch/Get API key

CVE-2026-84042

Crun: crun: rootful krun with passt executes container payload as host root

7.8 HighFix available

CVE-2026-84042 is a high vulnerability (CVSS 7.8) in Red Hat Enterprise Linux 10, published September 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.10%, the 0th percentile. Fixed in crun 1.30.1-r0.

What does this mean?
Severity
7.8 HighCVSS 3.1, CVE List
Exploit chance
0.10%EPSS, 0th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1.30.1-r0crun +16 more

Description

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.10%Unchanged since Sep 10, 2026
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
crun
Alpine:v3.24
before 1.30.1-r0
1.30.1-r0
crun
Alpaquita:stream
1.8.5-r0 up to 1.30.1-r0
1.30.1-r0
crun
Red Hat:enterprise_linux:9::appstream
before 0:1.29.1-1.el9
0:1.29.1-1.el9
crun-debuginfo
Red Hat:enterprise_linux:9::appstream
before 0:1.29.1-1.el9
0:1.29.1-1.el9
crun-debugsource
Red Hat:enterprise_linux:9::appstream
before 0:1.29.1-1.el9
0:1.29.1-1.el9
crun
Red Hat:enterprise_linux:10.3
before 0:1.30.1-1.el10_3
0:1.30.1-1.el10_3
crun-debuginfo
Red Hat:enterprise_linux:10.3
before 0:1.30.1-1.el10_3
0:1.30.1-1.el10_3
crun-debugsource
Red Hat:enterprise_linux:10.3
before 0:1.30.1-1.el10_3
0:1.30.1-1.el10_3
crun
Rocky Linux:9
before 0:1.29.1-1.el9
0:1.29.1-1.el9
crun-debuginfo
Rocky Linux:9
before 0:1.29.1-1.el9
0:1.29.1-1.el9
Show 7 moreShow less
Affected packages
PackageAffectedFixed
crun-debugsource
Rocky Linux:9
before 0:1.29.1-1.el9
0:1.29.1-1.el9
crun
Ubuntu:20.04:LTS
All versions, plus listed versions
0.10.5+dfsg-10.10.6+dfsg-10.11+dfsg-10.12+dfsg-10.12.1+dfsg-1
None known
crun
Ubuntu:22.04:LTS
All versions, plus listed versions
0.17+dfsg-10.17+dfsg-1.10.17+dfsg-1.1ubuntu0.1
None known
crun
Ubuntu:24.04:LTS
All versions, plus listed versions
1.8.5-11.11-11.11.1-11.12-11.13-11.14-11.14.1-1
None known
crun
Ubuntu:26.10
All versions, plus listed versions
1.21-1ubuntu3
None known
crun
Ubuntu:26.04:LTS
All versions, plus listed versions
1.21-1ubuntu21.21-1ubuntu3
None known
crun
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
before 1.30.1-1.1
1.30.1-1.1

What each source reports

CVE List Score used7.8

Crun: crun: rootful krun with passt executes container payload as host root

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29

Record
CVE-2026-84042
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-269
Updated
2026-11-11
EUVDEUVD-2026-753217.8

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29

Record
EUVD-2026-75321
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-11
GitHub AdvisoriesGHSA-ggww-wrxv-mmw27.8

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with...

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29

Record
GHSA-ggww-wrxv-mmw2
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-269
Updated
2026-11-11
NVD7.8

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29

Record
CVE-2026-84042
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-269
Updated
2026-11-11
OSVALPINE-CVE-2026-840427.8

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29

Record
ALPINE-CVE-2026-84042
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-03
OSVBELL-CVE-2026-840427.8
Record
BELL-CVE-2026-84042
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVRHSA-2026:975617.8

Red Hat Security Advisory: crun security, bug fix, and enhancement update

Record
RHSA-2026:97561
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-13
OSVRHSA-2026:985617.8

Red Hat Security Advisory: crun security update

Record
RHSA-2026:98561
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-13
OSVRLSA-2026:975617.8

Important: crun security, bug fix, and enhancement update

crun is a OCI runtime

Security Fix(es):

  • crun: crun: rootful krun with passt executes container payload as host root (CVE-2026-84042)

Bug Fix(es) and Enhancement(s):

  • crun should require container-selinux (JIRA:Rocky Linux-169227)

  • update to the latest upstream release (JIRA:Rocky Linux-185741)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

Record
RLSA-2026:97561
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-13
OSVUBUNTU-CVE-2026-840427.8

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29

Record
UBUNTU-CVE-2026-84042
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:12162-1No score

crun-1.30.1-1.1 on GA media

These are all security issues fixed in the crun-1.30.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12162-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, aliases, referencesEUVD, GitHub Advisories, NVD, OSV
referencesCVE List, GitHub Advisories, NVD
products, referencesCVE List
referencesEUVD
affected
factsNVD
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 15 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open