CVE-2026-15809

Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env

State: Published
Severity: 7.8 High
Published: Jul 15, 2026
Updated: Oct 1, 2026
Reserved: Jul 15, 2026

Description

A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	redhat

Weaknesses

CWE-134 Use of Externally-Controlled Format String
CWE-116 Improper Encoding or Escaping of Output

Affected Products

Product	Versions
Red Hat OpenShift Container Platform 4.12Red Hat	0:1.25.5-36.rhaos4.12.git2e7f657.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	0:1.26.5-32.rhaos4.13.git1088e36.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.14Red Hat	0:1.27.8-22.rhaos4.14.git0633bf1.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.15Red Hat	0:1.28.11-17.rhaos4.15.git48e6ddb.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.16Red Hat	0:1.29.13-14.rhaos4.16.git84cfdc6.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.17Red Hat	0:1.30.14-13.rhaos4.17.git3a25d98.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.18Red Hat	0:1.31.13-14.rhaos4.18.gitf2de9ac.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.19Red Hat	0:1.32.13-11.rhaos4.19.git089e95c.el9 and laterNot affected
Red Hat OpenShift Container Platform 4.20Red Hat	0:1.33.13-5.rhaos4.20.git7ebc848.el9 and laterNot affected
Red Hat OpenShift Container Platform 4.21Red Hat	0:1.34.11-4.rhaos4.21.git358c4b4.el9 and laterNot affected
Red Hat OpenShift Container Platform 4.22Red Hat	0:1.35.6-5.rhaos4.22.git41f610b.el9 and laterNot affected
Confidential Compute AttestationRed Hat
Red Hat OpenShift Container Platform 4Red Hat
Red Hat OpenShift Container Platform 4Red Hat

References

RHSA-2026:57361vendor-advisory
RHSA-2026:60444vendor-advisory
RHSA-2026:60449vendor-advisory
RHSA-2026:60452vendor-advisory
RHSA-2026:62548vendor-advisory
RHSA-2026:65838vendor-advisory
RHSA-2026:65906vendor-advisory
RHSA-2026:66385vendor-advisory
RHSA-2026:67836vendor-advisory
RHSA-2026:67856vendor-advisory
RHSA-2026:70585vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-15809vdb-entry
RHBZ#2500846issue-tracking
https://github.com/cri-o/cri-o/pull/6450
https://github.com/cri-o/cri-o/pull/6524

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.