Is CVE-2026-15809 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15809 being exploited in the wild.

How severe is CVE-2026-15809?

High severity, with a CVSS score of 7.8, published 15 July 2026.

Which products and versions are affected?

CRI-O All versions since December 14, 2022.

Is there a fix for CVE-2026-15809?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15809 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-15809?

Check whether you run CRI-O or Red Hat Confidential Compute Attestation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15809: CRI-O /etc/passwd injection via HOME environment variable bypass

CVE-2026-15809 · Severity: high · CVSS 7.8 · Published 2026-07-15

A security flaw was found in CRI-O, a key component used to run containers in Kubernetes environments like OpenShift. An attacker with the ability to set environment variables on a container can bypass existing security checks to modify the system's user database file (/etc/passwd). This could allow an attacker to gain unauthorized access, escalate their privileges, or disrupt container operations.

Technologies: CRI-O. Vendors: CRI-O, Red Hat.

Quick answers

Is CVE-2026-15809 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15809 being exploited in the wild.
How severe is CVE-2026-15809?: High severity, with a CVSS score of 7.8, published 15 July 2026.
Which products and versions are affected?: CRI-O All versions since December 14, 2022.
Is there a fix for CVE-2026-15809?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15809 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-15809?: Check whether you run CRI-O or Red Hat Confidential Compute Attestation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A regression in CRI-O exists because the fix for CVE-2022-4318 incorrectly used a Go raw string literal (`\n`) instead of an interpreted string literal ("\n") when checking for newline characters in the HOME environment variable. This causes the validation logic to search for the literal characters '\' and 'n' rather than the actual newline byte (0x0a). An attacker capable of making a CRI CreateContainer request can supply a real newline character in the HOME variable. This unsanitized value is subsequently passed to utils.GeneratePasswd, which uses fmt.Sprintf to construct the container's /etc/passwd file, enabling arbitrary line injection and potential privilege escalation.

Affected products

CRI-O CRI-O All versions since December 14, 2022
Red Hat Red Hat OpenShift Container Platform 4
Red Hat Confidential Compute Attestation

Timeline

2026-07-15: disclosed: Vulnerability reported and recorded in NVD and Red Hat Bugzilla.
2022-12-14: other: The original incorrect fix was introduced into the codebase.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.