CVE-2026-15809Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env

Description

A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.

Timeline

Scores

EPSS (exploitation in 30 days)

0.18% · top 92% of all CVEs (14 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Affected products

• Red Hat · Red Hat OpenShift Container Platform 4.12

  • unaffected 0:1.25.5-36.rhaos4.12.git2e7f657.el8 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.13

  • unaffected 0:1.26.5-32.rhaos4.13.git1088e36.el8 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.14

  • unaffected 0:1.27.8-22.rhaos4.14.git0633bf1.el8 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.15

  • unaffected 0:1.28.11-17.rhaos4.15.git48e6ddb.el8 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.16

  • unaffected 0:1.29.13-14.rhaos4.16.git84cfdc6.el8 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.17

  • unaffected 0:1.30.14-13.rhaos4.17.git3a25d98.el8 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.18

  • unaffected 0:1.31.13-14.rhaos4.18.gitf2de9ac.el8 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.19

  • unaffected 0:1.32.13-11.rhaos4.19.git089e95c.el9 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.20

  • unaffected 0:1.33.13-5.rhaos4.20.git7ebc848.el9 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.21

  • unaffected 0:1.34.11-4.rhaos4.21.git358c4b4.el9 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.22

  • unaffected 0:1.35.6-5.rhaos4.22.git41f610b.el9 – < *

• Red Hat · Confidential Compute Attestation

  All versions: affected

• Red Hat · Red Hat OpenShift Container Platform 4

  All versions: affected

• Red Hat · Red Hat OpenShift Container Platform 4

  All versions: affected

• Red Hat · Red Hat OpenShift Container Platform 5

  All versions: affected

What to do

Workaround: Restrict access to users who can create or modify container workloads through appropriate RBAC permissions, apply security controls such as Security Context Constraints (SCCs) to limit privilege escalation, and enforce policies to run containers with reduced privileges (for example, as non-root) to reduce the impact of potential exploitation. Enable SELinux on affected nodes and consider admission controls to prevent potentially unsafe workload configurations.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-44661 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-15809](https://cveledger.app/badge/CVE-2026-15809.svg)](https://cveledger.app/cve/CVE-2026-15809)

Record last updated 2 Nov 2026, 17:52 UTC.