CVE-2026-30892

crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the crun exec option -u (--user) is incorrectly parsed. The value 1 is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.

Database specific

{
    "cwe_ids": [
        "CWE-269"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30892.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/containers/crun

Affected ranges

Type

GIT

Repo

https://github.com/containers/crun

Events

Introduced

db31c42ac46e20b5527f5339dcbf6f023fcd539c

Fixed

a718a92cc9a94955a5a550b6fdec1378c247ec50

Fixed

1bd7f42446999b0e76bc3d575392e05c943b0b01

Database specific

{
    "cpe": "cpe:2.3:a:crun_project:crun:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.19"
        },
        {
            "fixed": "1.27"
        }
    ]
}

Database specific

vanir_signatures_modified

"2026-07-22T00:20:47Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30892.json"

vanir_signatures

[
    {
        "target": {
            "file": "src/exec.c",
            "function": "make_oci_process_user"
        },
        "deprecated": false,
        "digest": {
            "length": 813.0,
            "function_hash": "217923352513439732604943687232803571938"
        },
        "source": "https://github.com/containers/crun/commit/1bd7f42446999b0e76bc3d575392e05c943b0b01",
        "signature_version": "v1",
        "id": "CVE-2026-30892-bd996ee5",
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "src/exec.c"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "140354732762570311713944843750316391936",
                "67511837870273901906060439744638368957",
                "139598243602130319362301049863771081811",
                "126523361623627528917351033955973349061",
                "140806912672021309070413532959128705777",
                "295016058103868607953778675894204063645",
                "47872242544892548234893881002032098783",
                "124961134618404021083477495318645557569",
                "124303500434605030465586478779644608369",
                "188183196224890812055160243290979417985",
                "82473754581907071453076124133415769341"
            ]
        },
        "source": "https://github.com/containers/crun/commit/1bd7f42446999b0e76bc3d575392e05c943b0b01",
        "signature_version": "v1",
        "id": "CVE-2026-30892-dd46f8f7",
        "signature_type": "Line"
    }
]