Vulnerability Description
crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.
CVSS Score
NONE
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Crun Project | Crun | >= 1.19, < 1.27 |
Related Weaknesses (CWE)
References
- https://github.com/containers/crun/commit/1bd7f42446999b0e76bc3d575392e05c943b0bPatch
- https://github.com/containers/crun/releases/tag/1.27Product
- https://github.com/containers/crun/security/advisories/GHSA-4vg2-xjqj-7chjExploitVendor Advisory
FAQ
What is CVE-2026-30892?
CVE-2026-30892 is a vulnerability with a CVSS score of 0.0 (NONE). crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and...
How severe is CVE-2026-30892?
CVE-2026-30892 has been rated NONE with a CVSS base score of 0.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-30892?
Check the references section above for vendor advisories and patch information. Affected products include: Crun Project Crun.