Vulnerability · Published Jul 15, 2026 · Assigned by redhat
CVE-2026-15809Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env
High 7.8
In plain English
A high-severity security flaw in Confidential Compute Attestation from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Official description
A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4.12 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | see references |
| Red Hat | Confidential Compute Attestation | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
| Red Hat | Red Hat OpenShift Container Platform 5 | see references |
Weakness: CWE-134, CWE-116 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- RHSA-2026:57361 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:60444 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:60449 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:60452 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:62548 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:65838 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:65906 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:66385 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:67836 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:67856 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70585 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-15809 vdb-entry, x_refsource_REDHAT
- RHBZ#2500846 issue-tracking, x_refsource_REDHAT
- https://github.com/cri-o/cri-o/pull/6450
- https://github.com/cri-o/cri-o/pull/6524