CVE-2026-15809

Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env

En bref

Sévérité: HIGH 7.8
EPSS: EPSS 0.18 % · centile 8 (2026-10-27)
État: PUBLISHED
Publiée: 2026-07-15
Mise à jour: 2026-10-01
Attribuée par: redhat
Statut NVD: Deferred

Description

A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	redhat
CVSS 3.1	HIGH 7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	NVD · secalert@redhat.com (Secondary)

Faiblesses (CWE)

Références européennes

ENISA EUVD · EUVD-2026-44661
GCVE · GCVE-0-2026-15809

Produits affectés

Produit	Versions
Red Hat · Red Hat OpenShift Container Platform 4.12	unaffected 0:1.25.5-36.rhaos4.12.git2e7f657.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 0:1.26.5-32.rhaos4.13.git1088e36.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.14	unaffected 0:1.27.8-22.rhaos4.14.git0633bf1.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.15	unaffected 0:1.28.11-17.rhaos4.15.git48e6ddb.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.16	unaffected 0:1.29.13-14.rhaos4.16.git84cfdc6.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.17	unaffected 0:1.30.14-13.rhaos4.17.git3a25d98.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.18	unaffected 0:1.31.13-14.rhaos4.18.gitf2de9ac.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.19	unaffected 0:1.32.13-11.rhaos4.19.git089e95c.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.20	unaffected 0:1.33.13-5.rhaos4.20.git7ebc848.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.21	unaffected 0:1.34.11-4.rhaos4.21.git358c4b4.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.22	unaffected 0:1.35.6-5.rhaos4.22.git41f610b.el9 < *
Red Hat · Confidential Compute Attestation
Red Hat · Red Hat OpenShift Container Platform 4
Red Hat · Red Hat OpenShift Container Platform 4

Références

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD