CVE-2026-30892 - Vulnerability Analysis

Overview

crun 1.19 through 1.26 contains a broken access control vulnerability caused by incorrect parsing of the `-u` (`--user`) option in `crun exec`, letting attackers run processes with elevated privileges, exploit requires use of the `-u` option with value `1`.

Severity & Score

Impact

Attackers can run processes with root privileges instead of intended user, leading to privilege escalation.

Mitigation

Update to version 1.27 or later.

References

• https://github.com/containers/crun/commit/1bd7f42446999b0e76bc3d575392e05c943b0b01
• https://github.com/containers/crun/releases/tag/1.27
• https://github.com/containers/crun/security/advisories/GHSA-4vg2-xjqj-7chj

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner