Privilege Escalation Vulnerability in crun Package
Summary
ALSA-2026:6622: Moderate: crun security update. Affects crun versions < 1.27-1.el10_1. Fixed in 1.27-1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
crun is an Open Container Initiative (OCI) runtime designed for running containers efficiently. It is known for its lightweight nature and compatibility with various container orchestration systems. However, a recent vulnerability has been identified that could allow unauthorized privilege escalation due to improper parsing of the '--user' option.
Vulnerability Detail
The vulnerability arises from incorrect handling of the '--user' option in the crun package, which can lead to privilege escalation. This means that an attacker could potentially gain elevated permissions on the system, allowing them to execute unauthorized commands or access sensitive data. The issue is tracked under CVE-2026-30892 and poses a moderate risk to systems utilizing the affected version of crun.
How To Fix
Minimum fixed version
1.27-1.el10_1
This is the first release that contains the fix.
sudo dnf update crunTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the '--user' option until the package is updated. This will help mitigate the risk of privilege escalation until a proper fix is applied.
Conclusion
The crun package has a moderate vulnerability that could lead to privilege escalation due to improper handling of the '--user' option. Users are advised to update to the patched version 1.27-1.el10_1 or later to mitigate this risk. Until then, avoiding the use of the '--user' option is recommended.
See every vulnerability recorded for crun →
FAQ
crun is an OCI runtime that allows for the efficient execution of containers. It is designed to be lightweight and fast, making it suitable for various containerized applications.
CVE-2026-30892 refers to a privilege escalation vulnerability in the crun package caused by incorrect parsing of the '--user' option, which could allow attackers to gain elevated permissions.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to install any software.
If an immediate update is not possible, refrain from using the '--user' option in your crun commands to minimize the risk of privilege escalation until you can apply the fix.
For more details, you can refer to the CVE page associated with CVE-2026-30892, which provides in-depth information about the vulnerability, its impact, and mitigation strategies.
Related vulnerabilities
Recent vulnerabilities recorded for crun.
