CVE-2026-15809: CRI-O Auth Bypass Vulnerability

CVE-2026-15809 Overview

A flaw was found in CRI-O, the Kubernetes Container Runtime Interface implementation for OCI-compatible runtimes. The patch for a prior vulnerability, CVE-2022-4318, was incomplete and can be bypassed. An attacker who can set environment variables on a container can inject a newline character into the HOME environment variable. The injected newline causes CRI-O to append arbitrary lines into /etc/passwd inside the container, enabling local privilege escalation. The issue is tracked under [CWE-134] (Use of Externally-Controlled Format String) and [CWE-116] (Improper Encoding or Escaping of Output).

Critical Impact
An attacker with permission to set container environment variables can write arbitrary entries to /etc/passwd, leading to full compromise of container confidentiality, integrity, and availability.

Affected Products

CRI-O container runtime (versions containing the incomplete fix for CVE-2022-4318)
Red Hat OpenShift Container Platform distributions bundling affected CRI-O builds
Kubernetes deployments using CRI-O as the container runtime

Discovery Timeline

2026-07-15 - CVE-2026-15809 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-15809

Vulnerability Analysis

CRI-O manages container lifecycle operations on behalf of Kubernetes, including the construction of the container's user database. When CRI-O processes the HOME environment variable to generate a /etc/passwd entry for the container user, it fails to sanitize newline characters (\n). This is a regression: the original fix for CVE-2022-4318 addressed the same class of injection but did not cover all input paths.

An attacker who can influence the container specification, for example through a Pod manifest, ConfigMap, or Downward API, can set HOME to a value containing a newline followed by an arbitrary passwd entry. CRI-O then writes the crafted line into /etc/passwd, adding an attacker-controlled user account with elevated privileges inside the container.

The vulnerability requires local access with low privileges and no user interaction. Successful exploitation yields high impact to confidentiality, integrity, and availability within the container boundary.

Root Cause

The root cause is improper output encoding [CWE-116] when CRI-O serializes the HOME environment variable into the container's /etc/passwd file. The runtime treats the value as trusted text and concatenates it directly into a line-delimited format without escaping or rejecting newline characters. The prior fix for CVE-2022-4318 sanitized some code paths but left at least one path unprotected, allowing the bypass.

Attack Vector

Exploitation requires the ability to set container environment variables. This is available to any user or workload authorized to create or modify Pods in a namespace. The attacker crafts an environment variable such as HOME=/home/user\nattacker:x:0:0::/root:/bin/bash in the Pod specification. When CRI-O starts the container, it appends the malicious line to /etc/passwd, creating a UID 0 account the attacker can su into from within the container. Refer to the Red Hat CVE-2026-15809 Advisory and GitHub PR #6524 for CRI-O for the corrected sanitization logic.

Detection Methods for CVE-2026-15809

Indicators of Compromise

Unexpected entries in a container's /etc/passwd file, particularly accounts with UID 0 that were not present in the base image.
Pod specifications or ConfigMaps containing environment variables with embedded newline characters (\n, %0A, or \\x0a).
CRI-O runtime logs showing container creation events with unusually long or multi-line HOME values.

Detection Strategies

Audit Kubernetes API server logs for Pod create and update requests where env values contain newline byte sequences.
Compare the /etc/passwd file inside running containers against the corresponding image layer to detect drift introduced at runtime.
Use admission controllers such as OPA Gatekeeper or Kyverno to reject Pod specifications whose environment variable values contain control characters.

Monitoring Recommendations

Enable Kubernetes audit logging at the RequestResponse level for Pod resources and forward events to a centralized analytics platform.
Monitor for privilege escalation activity inside containers, including invocations of su, sudo, or unexpected UID transitions.
Track CRI-O version inventory across nodes and alert when hosts run releases prior to the fixed version referenced in the vendor advisory.

How to Mitigate CVE-2026-15809

Immediate Actions Required

Upgrade CRI-O to a release that includes the fixes from GitHub PR #6450 for CRI-O and GitHub PR #6524 for CRI-O.
Apply vendor updates from your Kubernetes distribution, including patches referenced in the Red Hat CVE-2026-15809 Advisory.
Restrict create and update permissions on Pods to trusted principals through Kubernetes RBAC.

Patch Information

The CRI-O maintainers corrected the sanitization of the HOME environment variable in the pull requests linked above. Consult the Red Hat Bug Report #2500846 for the mapping of fixed versions to supported product streams and apply the corresponding errata for your distribution.

Workarounds

Deploy an admission policy that rejects Pod specifications where any environment variable value contains \n, \r, or other control characters.
Run containers with a read-only root filesystem so that runtime modifications to /etc/passwd fail.
Enforce non-root runAsUser and allowPrivilegeEscalation: false in Pod Security Standards to reduce the impact of an injected UID 0 account.

bash

# Example Kyverno policy fragment to block newline characters in env values
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: block-newline-in-env
spec:
  validationFailureAction: Enforce
  rules:
    - name: reject-control-chars-in-env
      match:
        any:
          - resources:
              kinds: ["Pod"]
      validate:
        message: "Environment variable values must not contain newline characters."
        pattern:
          spec:
            containers:
              - env:
                  - value: "!*\n*"