Crun CVE-2026-30892

The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) indicates a local attack vector with low complexity and no privileges required, but notably assigns zero impact to confidentiality, integrity, and availability in the base vector-a significant inconsistency with the privilege escalation tag and the actual threat model. This mismatch suggests the vector may be incomplete or improperly assigned. However, the EPSS score of 0.01% (percentile 2%) provides the most grounded real-world signal: it reflects near-zero exploitation probability in observed threat intelligence. The vulnerability requires local command execution access and precise misuse of the -u 1 flag value to trigger, limiting automated exploitation. No CISA KEV status, no public proof-of-concept, and minimal EPSS adoption indicate this is a low-priority finding despite the privilege escalation classification. The actual risk depends heavily on container runtime deployment context: if crun exec is exposed to untrusted local users who can control command arguments, risk increases; if it is confined to trusted administrators, risk is negligible. This is a defense-in-depth fix rather than a critical security issue.

A container administrator or DevOps operator intending to execute a command as UID 1 (a non-root unprivileged user) issues the command crun exec -u 1 <container> <command>. Due to the parsing defect, the process instead executes as UID 0 (root), allowing it to perform privileged operations (file system writes, privilege escalation within the container, or escapes if further vulnerabilities are present) that should have been blocked by the non-root user context. This scenario is most likely in multi-tenant or CI/CD environments where user namespacing is relied upon for security isolation.