CVE-2026-82457: su-exec Privilege Escalation Vulnerability

CVE-2026-82457 Overview

CVE-2026-82457 is a privilege escalation vulnerability in su-exec through version 0.3. The utility fails to validate numeric user and group identifiers parsed with strtol before assigning them to uid_t and gid_t types. Out-of-range values silently truncate to zero, which is the root user's identifier. Attackers who can influence the numeric UID or GID argument passed to su-exec can cause target programs to execute as root instead of the intended unprivileged account. The flaw is categorized as a numeric truncation error [CWE-681] and commonly affects container images that use su-exec as a lightweight setuid/setgid wrapper in entrypoint scripts.

Critical Impact
Local attackers who control the numeric identifier argument to su-exec gain root privileges on the target process, breaking the security boundary that container entrypoints rely on to drop privileges.

Affected Products

su-exec versions through 0.3
Container images and entrypoint scripts that invoke su-exec with attacker-influenced numeric UIDs or GIDs
Alpine-based and minimal Linux images that ship su-exec as a privilege-dropping helper

Discovery Timeline

2026-08-29 - CVE-2026-82457 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82457

Vulnerability Analysis

su-exec is a minimal C utility that switches to a target user and group before executing a program, similar to gosu or setpriv. It accepts a user specification that can be either a name or a numeric identifier. When the argument is numeric, su-exec uses strtol to convert the string into a long value and then assigns the result directly to uid_t and gid_t fields without a range check.

uid_t and gid_t are typically 32-bit unsigned types on Linux. Assigning a long that exceeds the type's range invokes implementation-defined truncation. Specific out-of-range inputs truncate to zero, and zero maps to the root account. The utility then calls setgid, setuid, and execvp with those truncated identifiers, running the target program with root privileges.

Root Cause

The root cause is missing bounds validation on the return value of strtol before narrowing conversion to uid_t and gid_t. The parser does not reject values outside the valid identifier range, does not check errno for ERANGE, and does not verify that the numeric value survives the narrowing conversion. This is a canonical instance of [CWE-681: Incorrect Conversion between Numeric Types].

Attack Vector

Exploitation requires local access and the ability to control the identifier argument passed to su-exec. In practical container deployments, this occurs when an entrypoint script forwards an environment variable, command-line flag, or configuration value directly into su-exec without sanitization. An attacker who can set that variable (for example, through a web application, orchestrator misconfiguration, or a lower-privileged shell) supplies a crafted numeric string that truncates to zero. su-exec then executes the downstream program as root rather than the intended service account.

Technical details and a proof of concept are documented in the VulnCheck Advisory for su-exec and the GitHub Gist PoC. The affected parsing logic can be reviewed in the GitHub su-exec Source Code.

Detection Methods for CVE-2026-82457

Indicators of Compromise

Container processes running as UID 0 when the entrypoint or Dockerfile intended a non-root UID.
Audit records showing execve of su-exec with a numeric user argument larger than 2^32.
Unexpected root-owned files or sockets created by services configured to run as an unprivileged user.
Shell history or process arguments containing very large integer values passed to su-exec.

Detection Strategies

Inventory container images for the presence of su-exec binaries and record their versions.
Enable Linux audit rules on execve to capture the full argument vector of su-exec invocations.
Compare the effective UID of long-running container processes against the UID declared in image metadata.
Alert on any su-exec invocation whose numeric UID or GID argument exceeds the platform's identifier range.

Monitoring Recommendations

Forward container runtime and audit logs to a centralized analytics platform for cross-host correlation.
Baseline the expected UID of each service account and generate detections when processes deviate.
Track environment variables consumed by entrypoint scripts and flag externally supplied values that reach su-exec.

How to Mitigate CVE-2026-82457

Immediate Actions Required

Identify all container images and hosts that ship su-exec through version 0.3.
Replace su-exec with a maintained alternative such as gosu, setpriv, or runuser where feasible.
Sanitize any entrypoint script that passes user-controlled input to su-exec, rejecting non-numeric input and values outside the valid UID/GID range.
Rebuild and redeploy affected container images once the wrapper is replaced or patched.

Patch Information

At the time of publication, the upstream GitHub Repository for su-exec has not shipped a fixed release beyond version 0.3. Consult the VulnCheck Advisory for su-exec for the latest remediation status and any downstream distribution patches. Distributions that ship su-exec should backport a range check on the strtol result and reject conversions that would narrow to zero unintentionally.

Workarounds

Wrap su-exec calls in a shell function that validates the numeric argument is within 0 to 2^32-1 and rejects zero unless explicitly intended.
Enforce a non-root USER directive in Dockerfiles so that even a successful truncation cannot escalate beyond the container's effective user namespace.
Run containers with a user namespace remap so that a truncated UID 0 maps to an unprivileged host UID.
Apply Linux capabilities restrictions and drop CAP_SETUID and CAP_SETGID from workloads that do not require privilege switching.

bash

# Configuration example: validate the numeric UID before invoking su-exec
target_uid="${APP_UID:-1000}"
case "$target_uid" in
    ''|*[!0-9]*) echo "invalid UID" >&2; exit 1 ;;
esac
if [ "$target_uid" -lt 1 ] || [ "$target_uid" -gt 4294967294 ]; then
    echo "UID out of range" >&2
    exit 1
fi
exec su-exec "$target_uid" "$@"