CVE-2026-30892 Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation
Attackers can escalate privileges by exploiting incorrect user ID parsing in crun exec, allowing processes to run as root instead of the specified user.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-30892?
CVE-2026-30892 is a vulnerability in containers crun, published on 25 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.
Weakness: CWE-269
Which versions are affected by CVE-2026-30892?
It affects 1 product.
Linux distribution packages (30)
crun AlmaLinux:10 | All versions | 1.27-1.el10_1 |
crun AlmaLinux:10 | All versions | 1.27-2.el10_2 |
crun-krun AlmaLinux:10 | All versions | 1.27-2.el10_2 |
crun AlmaLinux:9 | All versions | 1.27-1.el9_7 |
crun AlmaLinux:9 | All versions | 1.27-1.el9_8 |
crun Red Hat:enterprise_linux:10.1 | All versions | 0:1.27-1.el10_1 |
crun-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:1.27-1.el10_1 |
crun-debugsource Red Hat:enterprise_linux:10.1 | All versions | 0:1.27-1.el10_1 |
crun Red Hat:enterprise_linux:10.2 | All versions | 0:1.27-2.el10_2 |
crun-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:1.27-2.el10_2 |
crun-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:1.27-2.el10_2 |
crun-krun Red Hat:enterprise_linux:10.2 | All versions | 0:1.27-2.el10_2 |
crun Red Hat:enterprise_linux:9::appstream | All versions | 0:1.27-1.el9_7 |
crun Red Hat:enterprise_linux:9::appstream | All versions | 0:1.27-1.el9_8 |
crun-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.27-1.el9_7 |
crun-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.27-1.el9_8 |
crun-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:1.27-1.el9_7 |
crun-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:1.27-1.el9_8 |
container-selinux Red Hat:enterprise_linux_eus:10.0 | All versions | 4:2.246.0-1.el10_0 |
crun Red Hat:enterprise_linux_eus:10.0 | All versions | 0:1.27.1-1.el10_0 |
crun-debuginfo Red Hat:enterprise_linux_eus:10.0 | All versions | 0:1.27.1-1.el10_0 |
crun-debugsource Red Hat:enterprise_linux_eus:10.0 | All versions | 0:1.27.1-1.el10_0 |
crun Red Hat:rhel_eus:9.6::appstream | All versions | 0:1.27-1.el9_6 |
crun-debuginfo Red Hat:rhel_eus:9.6::appstream | All versions | 0:1.27-1.el9_6 |
crun-debugsource Red Hat:rhel_eus:9.6::appstream | All versions | 0:1.27-1.el9_6 |
crun Rocky Linux:10 | All versions | 0:1.27-1.el10_1 |
crun Rocky Linux:10 | All versions | 0:1.27-2.el10_2 |
crun Rocky Linux:9 | All versions | 0:1.27-1.el9_7 |
crun Rocky Linux:9 | All versions | 0:1.27-1.el9_7 |
crun openSUSE:Tumbleweed | All versions | 1.27-1.1 |
Products include Crun Project Crun.
How do I fix CVE-2026-30892?
Apply the vendor's patch.
Is CVE-2026-30892 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30892 exists.
Other vulnerabilities in containers crun
Sources
Also known as ALSA-2026:19020, ALSA-2026:19178, ALSA-2026:6621, ALSA-2026:6622, AZL-80951, BELL-CVE-2026-30892 and 15 more.