CVE-2026-30892

crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the crun exec option -u (--user) is incorrectly parsed. The value 1 is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-269"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30892.json"
}

References

Affected packages

Git / github.com/containers/crun

Affected ranges

Type

GIT

Repo

https://github.com/containers/crun

Events

Introduced

db31c42ac46e20b5527f5339dcbf6f023fcd539c

Fixed

a718a92cc9a94955a5a550b6fdec1378c247ec50

Fixed

1bd7f42446999b0e76bc3d575392e05c943b0b01

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:crun_project:crun:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.19"
                },
                {
                    "fixed":  "1.27"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "1bd7f42446999b0e76bc3d575392e05c943b0b01"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "1.27",
            "range":  [
                {
                    "fixed":  "a718a92cc9a94955a5a550b6fdec1378c247ec50"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30892.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "217923352513439732604943687232803571938",
            "length":  813
        },
        "id":  "CVE-2026-30892-bd996ee5",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/containers/crun/commit/1bd7f42446999b0e76bc3d575392e05c943b0b01",
        "target":  {
            "file":  "src/exec.c",
            "function":  "make_oci_process_user"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "140354732762570311713944843750316391936",
                "67511837870273901906060439744638368957",
                "139598243602130319362301049863771081811",
                "126523361623627528917351033955973349061",
                "140806912672021309070413532959128705777",
                "295016058103868607953778675894204063645",
                "47872242544892548234893881002032098783",
                "124961134618404021083477495318645557569",
                "124303500434605030465586478779644608369",
                "188183196224890812055160243290979417985",
                "82473754581907071453076124133415769341"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-30892-dd46f8f7",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/containers/crun/commit/1bd7f42446999b0e76bc3d575392e05c943b0b01",
        "target":  {
            "file":  "src/exec.c"
        }
    }
]

vanir_signatures_modified

"2026-10-21T09:50:55Z"