What’s Vulnerable › Vulnerabilities

CVE-2026-15809: Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-15 · updated 2026-10-01
• Weakness: CWE-134

Description

A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.

Affected products

• Red Hat Confidential Compute Attestation: all versions
• Red Hat OpenShift Container Platform 4.18: all versions — fixed in 0:1.31.13-14.rhaos4.18.gitf2de9ac.el8
• Red Hat OpenShift Container Platform 4.12: all versions — fixed in 0:1.25.5-36.rhaos4.12.git2e7f657.el8
• Red Hat OpenShift Container Platform 4.13: all versions — fixed in 0:1.26.5-32.rhaos4.13.git1088e36.el8
• Red Hat OpenShift Container Platform 4.14: all versions — fixed in 0:1.27.8-22.rhaos4.14.git0633bf1.el8
• Red Hat OpenShift Container Platform 4.15: all versions — fixed in 0:1.28.11-17.rhaos4.15.git48e6ddb.el8
• Red Hat OpenShift Container Platform 4.16: all versions — fixed in 0:1.29.13-14.rhaos4.16.git84cfdc6.el8
• Red Hat OpenShift Container Platform 4.17: all versions — fixed in 0:1.30.14-13.rhaos4.17.git3a25d98.el8
• Red Hat OpenShift Container Platform 4.19: all versions — fixed in 0:1.32.13-11.rhaos4.19.git089e95c.el9
• Red Hat OpenShift Container Platform 4.20: all versions — fixed in 0:1.33.13-5.rhaos4.20.git7ebc848.el9
• Red Hat OpenShift Container Platform 4.21: all versions — fixed in 0:1.34.11-4.rhaos4.21.git358c4b4.el9
• Red Hat OpenShift Container Platform 4.22: all versions — fixed in 0:1.35.6-5.rhaos4.22.git41f610b.el9

How to fix

Upgrade to a fixed version: Red Hat OpenShift Container Platform 4.18 0:1.31.13-14.rhaos4.18.gitf2de9ac.el8; Red Hat OpenShift Container Platform 4.12 0:1.25.5-36.rhaos4.12.git2e7f657.el8; Red Hat OpenShift Container Platform 4.13 0:1.26.5-32.rhaos4.13.git1088e36.el8; Red Hat OpenShift Container Platform 4.14 0:1.27.8-22.rhaos4.14.git0633bf1.el8; Red Hat OpenShift Container Platform 4.15 0:1.28.11-17.rhaos4.15.git48e6ddb.el8; Red Hat OpenShift Container Platform 4.16 0:1.29.13-14.rhaos4.16.git84cfdc6.el8; Red Hat OpenShift Container Platform 4.17 0:1.30.14-13.rhaos4.17.git3a25d98.el8; Red Hat OpenShift Container Platform 4.19 0:1.32.13-11.rhaos4.19.git089e95c.el9; Red Hat OpenShift Container Platform 4.20 0:1.33.13-5.rhaos4.20.git7ebc848.el9; Red Hat OpenShift Container Platform 4.21 0:1.34.11-4.rhaos4.21.git358c4b4.el9; Red Hat OpenShift Container Platform 4.22 0:1.35.6-5.rhaos4.22.git41f610b.el9. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:57361
• https://access.redhat.com/errata/RHSA-2026:60444
• https://access.redhat.com/errata/RHSA-2026:60449
• https://access.redhat.com/errata/RHSA-2026:60452
• https://access.redhat.com/errata/RHSA-2026:62548
• https://access.redhat.com/errata/RHSA-2026:65838
• https://access.redhat.com/errata/RHSA-2026:65906
• https://access.redhat.com/errata/RHSA-2026:66385
• https://access.redhat.com/errata/RHSA-2026:67836
• https://access.redhat.com/errata/RHSA-2026:67856
• https://access.redhat.com/errata/RHSA-2026:70585
• https://access.redhat.com/security/cve/CVE-2026-15809

Get alerted when CVE-2026-15809 or the next vulnerability affects your stack