CVE-2026-30892

CVE-2026-30892 affects the crun container runtime. In versions 1.19–1.26, the crun exec option -u/--user is parsed incorrectly, causing the value '1' to be treated as UID 0 and GID 0 instead of UID 1 and GID 0. This grants higher privileges to the executed process. The issue is fixed in version 1...

CVE-2026-30892 Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation

crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the crun exec option -u --user is incorrectly parsed. The value 1 is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected...