Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
Amazon Linux crun: Escalating Privileges via User Option
published 6 months ago
Summary
A security update is available for crun, a software tool used by Amazon Linux. If exploited, this vulnerability could allow an attacker to gain elevated access and control over the system. Update to the latest version of crun to protect your system.
What to do
- Update rocky crun to version 0:1.27-1.el10_1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Rocky Linux:10 | rocky | crun |
< 0:1.27-1.el10_1 Fix: upgrade to 0:1.27-1.el10_1
|
Original advisory text
Moderate: crun security update
crun is a OCI runtime
Security Fix(es):
* crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://errata.rockylinux.org/RLSA-2026:6622 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2451576 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published9 Apr 2026
Updated9 Apr 2026
First seen9 Apr 2026
Sources
RLSA-2026:6622 · OSV
Track software like this
Free during beta