crun analyse incorrectement l'option `crun exec` `-u`, entraînant une élévation de privilèges

The core of this vulnerability lies in the misinterpretation of the -u or --user flag in crun exec. When a user attempts to specify a UID of '1' using this flag, crun incorrectly interprets it as UID 0 and GID 0 (root). This allows an attacker to bypass intended privilege restrictions and execute commands with root privileges within the container. Successful exploitation could lead to complete container compromise, potentially enabling attackers to access sensitive data, modify container configurations, or even escape the container and impact the host system, depending on container isolation settings. This is particularly concerning in multi-tenant environments where containers share the same host.

1. Réservé2026-03-06
2. Publiée2026-03-25
3. Modifiée2026-03-26
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2026-30892 is to upgrade to crun version 1.27 or later, which contains the fix for the incorrect parsing of the -u flag. If upgrading is not immediately feasible, consider restricting the use of the -u flag in crun exec to trusted users or processes. Implement strict container isolation policies to limit the potential impact of a compromised container. Monitor container execution logs for suspicious activity, particularly commands executed with UID 0. While a WAF is unlikely to directly address this vulnerability, enforcing least privilege principles for container users can reduce the attack surface.