CVE-2026-84042

Awaiting Analysis Awaiting Analysis - Queue

crun Root Privilege Escalation via Passt Networking

Publication date: 2026-09-10

Last updated on: 2026-09-15

Assigner: redhat-SADP

Description

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-15

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-84042

EUVD

EUVD-2026-75321

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

CVE-2026-84042 is a flaw in crun, a lightweight container runtime, when built with libkrun. It occurs when starting a container rootful with passt networking enabled. This allows attacker-controlled payloads from the container image to execute with host root privileges. The issue is a regression introduced in crun version 1.29 and affects versions 1.29 and later.

Detection Guidance

Check if crun is built with libkrun and if containers are started rootful with passt networking (krun.use_passt). Inspect crun version with 'crun --version' and verify if it is 1.29 or higher. Examine container runtime configurations for passt networking usage.

Impact Analysis

This vulnerability allows an attacker with local access to execute malicious code on the host system with root privileges. This could lead to complete system compromise, data theft, or disruption of services. The high CVSS score of 7.8 indicates significant confidentiality, integrity, and availability risks.

Compliance Impact

This vulnerability allows attacker-controlled payloads from container images to execute with host root privileges under specific conditions. This could lead to unauthorized access, data breaches, or system compromise, which may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data security) by exposing sensitive information or failing to maintain proper access controls.

Mitigation Strategies

Avoid using untrusted container images with krun and passt networking. Do not start containers rootful with passt networking until a fixed crun version is released. Monitor for updates from crun maintainers and apply patches once available.

Hi! I’m here to help you understand CVE-2026-84042. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70