CVE-2026-30892: Crun Privilege Escalation Vulnerability

CVE-2026-30892 Overview

CVE-2026-30892 is a privilege escalation vulnerability in crun, an Open Container Initiative (OCI) container runtime written in C. The flaw affects versions 1.19 through 1.26 and resides in how the crun exec command parses the -u (--user) flag. When an operator passes the value 1, the runtime interprets it as UID 0 and GID 0 instead of UID 1 and GID 0. The process therefore runs as root inside the container rather than as the intended unprivileged user. Maintainers patched the issue in version 1.27 (GHSA-4vg2-xjqj-7chj).

Critical Impact
A local user invoking crun exec -u 1 receives root (UID 0) inside the target container, bypassing the expected user isolation boundary and enabling further privilege escalation [CWE-269].

Affected Products

crun versions 1.19 through 1.26
Container platforms bundling vulnerable crun builds (Podman, Buildah, CRI-O deployments)
Linux distributions shipping crun as the default OCI runtime

Discovery Timeline

2026-03-26 - CVE-2026-30892 published to NVD
2026-03-27 - Last updated in NVD database

Technical Details for CVE-2026-30892

Vulnerability Analysis

The vulnerability is an improper privilege management issue [CWE-269] caused by an ordering bug in the user specification parser in src/exec.c. The crun exec command accepts a USERSPEC argument of the form UID[:GID]. When a caller specifies only a UID, the parser reads the value with strtoll, but the code path that assigns u->uid = (int) l is placed after the early return that handles the UID-only case. As a result, the parsed UID never reaches the structure member used downstream, and the field retains its zero-initialized value. The container exec call then runs the process with UID 0 instead of the requested numeric UID.

Root Cause

The bug is a logic error in field assignment order. The original code validated bounds and assigned u->uid only on the :-separated branch of the parser, leaving the simpler UID-only branch with an uninitialized UID field. The defaulted value of 0 caused crun to drop into the root user inside the container.

Attack Vector

Exploitation requires local access and the ability to invoke crun exec against a running container, which typically means membership in groups that interact with the container runtime or access to a user-namespaced rootless container. An attacker passes -u 1 (or another low integer where the assignment was skipped) and receives a shell or process running as UID 0 inside the container. From there, the attacker can read or modify root-owned files in the container, abuse mounted host paths, or chain with container escape primitives.

   l = strtoll (userspec, &endptr, 10);
   if (errno == ERANGE)
     libcrun_fail_with_error (0, "invalid UID specified");
+  if (l < INT_MIN || l > INT_MAX)
+    libcrun_fail_with_error (0, "invalid UID specified");
+  u->uid = (int) l;
   if (*endptr == '\0')
     return u;
   if (*endptr != ':')
     libcrun_fail_with_error (0, "invalid USERSPEC specified");
-  if (l < INT_MIN || l > INT_MAX)
-    libcrun_fail_with_error (0, "invalid UID specified");
-
-  u->uid = (int) l;
 
   errno = 0;
   l = strtoll (endptr + 1, &endptr, 10);

Source: containers/crun commit 1bd7f42. The patch moves the bounds check and u->uid assignment ahead of the early return so the UID is always populated before the function exits.

Detection Methods for CVE-2026-30892

Indicators of Compromise

Process trees where crun exec -u <non-zero-uid> results in a child process running with EUID 0 inside the container namespace.
Container audit logs showing UID 0 activity from sessions that were initiated with a non-root --user argument.
Installed crun package version between 1.19 and 1.26 on container hosts.

Detection Strategies

Inventory all container hosts and confirm the installed crun version with crun --version; flag any release in the 1.19–1.26 range.
Audit shell history, systemd journals, and container engine logs (Podman, CRI-O) for crun exec invocations using the -u or --user flag.
Compare the requested UID in exec invocations against the actual EUID observed inside the container at runtime.

Monitoring Recommendations

Enable Linux audit rules on execve calls of the crun binary and alert on -u arguments paired with subsequent root-owned file writes inside container rootfs paths.
Forward container runtime logs to a centralized SIEM and build correlations between exec user-spec arguments and post-exec UID telemetry.
Track package update status for crun across the fleet to detect hosts that remain on vulnerable builds.

How to Mitigate CVE-2026-30892

Immediate Actions Required

Upgrade crun to version 1.27 or later on every container host, including build, CI, and Kubernetes worker nodes.
Restrict access to the container runtime socket and the crun binary to trusted operators until patching is complete.
Review recent crun exec invocations for unexpected root activity and rotate any secrets that may have been exposed inside affected containers.

Patch Information

The fix is included in the crun 1.27 release and tracked in commit 1bd7f42446999b0e76bc3d575392e05c943b0b01. Distribution-specific package updates are referenced in the GitHub Security Advisory GHSA-4vg2-xjqj-7chj.

Workarounds

Avoid using crun exec -u <uid> until the host is upgraded; use podman exec user mapping or set the user inside the container image instead.
Switch the OCI runtime to a non-affected alternative such as runc for hosts that cannot be updated immediately.
Enforce least-privilege user namespaces and read-only root filesystems so an unexpected UID 0 process has limited impact.

bash

# Verify the installed crun version and upgrade if vulnerable
crun --version

# Example: upgrade on Fedora/RHEL-family hosts
sudo dnf upgrade --refresh crun

# Example: switch Podman to runc as a temporary workaround
podman --runtime /usr/bin/runc exec -u 1 mycontainer /bin/sh