CVE-2026-15809

Deferred Deferred - Pending Action

Incorrect Fix Bypass in CRI-O Allows Arbitrary /etc/passwd Modification

Publication date: 2026-07-15

Last updated on: 2026-07-16

Assigner: Red Hat, Inc.

Description

A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-16

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-03

NVD

CVE-2026-15809

EUVD

EUVD-2026-44661

Affected Vendors & Products

Vendor	Product	Version / Range
cri-o	cri-o	1.25.0
redhat	cri-o	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-134	The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

CVE-2026-15809 is a bypass for a previous vulnerability (CVE-2022-4318) in CRI-O, a container runtime. The original fix for CVE-2022-4318 was flawed because it used a Go raw string literal instead of an interpreted string literal, causing the check to look for the literal two-character sequence "\n" rather than an actual newline character. This allowed attackers to inject a real newline into the HOME environment variable, enabling arbitrary line injection into the container's /etc/passwd file.

Detection Guidance

To detect this vulnerability, check if your CRI-O version is vulnerable by running: cri-o --version. If the version is before the fix (merged Dec 20, 2022), it may be vulnerable. Inspect container creation logs for errors related to HOME environment variables containing newlines. Use: journalctl -u crio --no-pager | grep -i 'newline' to search for failed container creations due to this issue.

Impact Analysis

An attacker with the ability to set environment variables on a container could exploit this to inject malicious entries into /etc/passwd, potentially leading to privilege escalation or unauthorized access within the container environment.

Compliance Impact

This vulnerability could lead to unauthorized access or privilege escalation, which may violate data integrity and confidentiality requirements under standards like GDPR and HIPAA. Unauthorized modifications to /etc/passwd could result in non-compliance with access control and audit logging mandates.

Mitigation Strategies

Update CRI-O to the latest version that includes the corrected fix for CVE-2022-4318. Monitor containers for suspicious environment variable modifications, particularly HOME variables containing newline characters.

Hi! I’m here to help you understand CVE-2026-15809. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70