unscored
CVE-2026-30892
crun is an open source OCI Container Runtime fully written in C.
Impact
crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Crun Project | Crun | from 1.19 before 1.27 |