CVE-2026-30892: crun project crun

csirt@kutim:~/threat-intel/cve/CVE-2026-30892

CVSS 7.8 · High EPSS 0,17%

Kerentanan Improper Privilege Management pada crun project crun. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.

Rincian

Terbit di NVD: 26 Maret 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-269: Improper Privilege Management
EPSS (30 hari): 0,17% peluang dieksploitasi; lebih tinggi dari 5,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
crun project	crun	Versi 1.19 hingga sebelum 1.27

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/containers/crun/security/advisories/GHSA-4vg2-xjqj-7chj exploit · advisory vendor
https://github.com/containers/crun/commit/1bd7f42446999b0e76bc3d575392e05c943b0b01 patch
https://github.com/containers/crun/releases/tag/1.27 product

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.