Vulnerability DatabaseCVE-2026-30892
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-30892
March 25, 2026
crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the "crun exec" option "-u" ("--user") is incorrectly parsed. The value "1" is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.
Affected Packages
https://github.com/containers/crun.git (GITHUB):
Affected version(s) >=0.4 <1.27
Fix Suggestion:
Update to version 1.27
https://github.com/containers/crun.git (GITHUB):
Affected version(s) >=0.4 <1.27
Fix Suggestion:
Update to version 1.27
https://github.com/containers/crun.git (GITHUB):
Affected version(s) >=0.4 <1.27
Fix Suggestion:
Update to version 1.27
Related Resources (3)
https://github.com/containers/crun/commit/1bd7f42446999b0e76bc3d575392e05c943b0b01
https://github.com/containers/crun/security/advisories/GHSA-4vg2-xjqj-7chj
https://github.com/containers/crun/releases/tag/1.27
Do you need more information?
Contact Us
Weakness Type (CWE)
Improper Privilege Management
CWE-269
EPSS
Base Score:
0.01