CVE-2026-30892 Details
Description
crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.
A privilege escalation vulnerability exists in the open-source OCI container runtime 'crun', specifically in versions 1.19 through 1.26. The issue arises in the 'crun exec' command when the '-u' or '--user' option is used. The runtime misinterprets the value '1', treating it as UID 0 and GID 0 instead of the correct UID 1 and GID 0. This misinterpretation allows processes to execute with unintended elevated privileges. The vulnerability has been addressed in version 1.27.
Users can upgrade to 'crun' version 1.27, which fixes the user option parsing issue. This version is available on the 'crun' GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| crun project crun | >= 1.19, < 1.27 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 27, 2026 | Reanalysis | [email protected] |
| Mar 26, 2026 | Initial Analysis | [email protected] |
| Mar 26, 2026 | New CVE Received | [email protected] |