Privilege Escalation Vulnerability in crun Package - Security Update Required
Summary
ALSA-2026:6621: Moderate: crun security update. Affects crun versions < 1.27-1.el9_7. Fixed in 1.27-1.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
crun is an Open Container Initiative (OCI) runtime that is designed to manage the lifecycle of containers. It is widely used in container orchestration and deployment, providing essential functionalities such as creating, starting, stopping, and deleting containers. The package is integral to many cloud-native applications and environments, making its security paramount. The vulnerability in question arises from improper parsing of the '--user' option, which can lead to privilege escalation, allowing unauthorized users to gain elevated access.
Vulnerability Detail
The vulnerability identified as CVE-2026-30892 in the crun package stems from incorrect parsing of the '--user' option. This flaw can be exploited by attackers to escalate their privileges within the system, potentially leading to unauthorized access to sensitive data or system controls. The ramifications of this vulnerability are significant, as it can compromise the integrity and confidentiality of the system where crun is deployed. It is crucial for users of crun to understand the risks associated with this vulnerability and take appropriate action to mitigate them.
How To Fix
Minimum fixed version
1.27-1.el9_7
This is the first release that contains the fix.
sudo dnf update crunTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the '--user' option until the package is updated to mitigate the risk of privilege escalation. Additionally, restricting access to the crun runtime to trusted users only can help reduce the potential attack surface.
Conclusion
The crun package has a significant vulnerability (CVE-2026-30892) that can lead to privilege escalation due to improper parsing of the '--user' option. Users are advised to update to the patched version 1.27-1.el9_7 to mitigate this risk. Until the update can be applied, users should avoid using the '--user' option and limit access to the runtime.
See every vulnerability recorded for crun →
FAQ
crun is an OCI runtime that manages container lifecycles, providing essential functionalities for container orchestration.
CVE-2026-30892 refers to a specific vulnerability in the crun package that allows for privilege escalation due to incorrect parsing of the '--user' option.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, avoid using the '--user' option and restrict access to the crun runtime to trusted users only.
Addressing this vulnerability is crucial to prevent unauthorized access and ensure the security and integrity of systems using the crun package.
Related vulnerabilities
Recent vulnerabilities recorded for crun.
