CVE-2026-15809
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A flaw was found in CRI-O where the fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME variable, enabling arbitrary lines to be added to /etc/passwd.
Risk Assessment
The risk involves potential privilege escalation within a container by manipulating /etc/passwd, which could lead to unauthorized access to the system or other containers.
Recommendation
It is recommended to immediately update CRI-O to the latest version with the correct fix and restrict the ability to set environment variables by unauthorized users.
Other vulnerabilities in CRI-O
See all- CVE-2026-17113Medium
CRI-O has a vulnerability in environment-variable handling during container creation. When a CreateContainer request has a nil Envs field, CRI-O uses unfiltered config.Env entries from the OCI image, which can cause a Go panic and crash the crio daemon. This occurs when an entry lacks '='.
- CVE-2025-4437Medium
There's a vulnerability in the CRI-O application where when a container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause high memory consumption leading applications to be killed due to out-of-memory. As a result a denial-of-service can be achieved, possibly disrupting other pods and services running on the same host.
- CVE-2024-5154High
A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.
Original NVD description (English source)
A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.