Docker CVE-2026-30892

NONE

Improper Privilege Management (CWE-269)

2026-03-25 GitHub_M

Docker Linux Privilege Escalation Crun

Severity by source

GitHub Advisory

0.0 LOW

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 26, 2026 - 00:12 vuln.today

CVE Published

Mar 25, 2026 - 23:57 nvd

NONE

DescriptionGitHub Advisory

crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the crun exec option -u (--user) is incorrectly parsed. The value 1 is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.

AnalysisAI

crun versions 1.19 through 1.26 misparse the -u (--user) option during container execution, causing a numeric UID value of 1 to be incorrectly interpreted as UID 0 (root) instead, resulting in privilege escalation where containerized processes execute with root privileges instead of the intended unprivileged user. The vulnerability affects the containers/crun OCI runtime container (cpe:2.3:a:containers:crun:*:*:*:*:*:*:*:*) and has been patched in version 1.27. No public exploit code or active exploitation has been identified, though the EPSS score of 0.01% (percentile 2%) indicates minimal real-world exploitation likelihood despite the privilege escalation tag.

Technical ContextAI

crun is an open source OCI (Open Container Initiative) container runtime implemented entirely in C. The vulnerability resides in the argument parsing logic for the crun exec command, specifically the handler for the -u / --user flag which specifies the UID and GID context under which a command executes within a running container. The root cause falls under CWE-269 (Improper Access Control), manifesting as an integer parsing defect where the string value '1' is mapped to UID 0 rather than UID 1. This is a subtle type confusion or off-by-one-style parsing error in the user credential resolution mechanism. Affected versions range from 1.19 through 1.26 (cpe:2.3:a:containers:crun:*:*:*:*:*:*:*:*), with the fix incorporated in version 1.27.

RemediationAI

Upgrade crun to version 1.27 or later to apply the upstream fix. Organizations running crun 1.19-1.26 should prioritize this upgrade, particularly in environments where container execution is exposed to local user accounts or where user-supplied arguments to crun exec -u are possible. If immediate patching is not feasible, restrict access to the crun exec command and its -u flag to trusted administrators only, and audit container execution logs for any use of -u 1 or similar single-digit UID values that may indicate accidental privilege escalation. For additional context and technical details, consult the GitHub security advisory at https://github.com/containers/crun/security/advisories/GHSA-4vg2-xjqj-7chj.