CVE-2026-15809 Red Hat CVE debrief

Who should care

Users of CRI-O containers, especially those allowing untrusted users to set environment variables, should assess the risk of this vulnerability and take necessary actions. This includes operators managing container environments, platform administrators, vulnerability management teams, and security teams that need to evaluate and mitigate the impact of CVE-2026-15809.

Technical summary

The CVE-2026-15809 vulnerability in CRI-O allows an attacker to bypass the fix for CVE-2022-4318 by injecting a newline character into the HOME environment variable of a container. This can lead to the addition of arbitrary lines into /etc/passwd, potentially allowing for privilege escalation or other malicious activities. The vulnerability has a high CVSS score of 7.8 and is considered High severity. Affected product deployments should be identified in managed environments, and owners should be assigned for follow-up.

Defensive priority

High

Recommended defensive actions

• Review and update CRI-O to the latest version that includes the correct fix for CVE-2022-4318 and CVE-2026-15809.
• Restrict the ability to set environment variables in containers to trusted users only.
• Monitor container environments for suspicious activity, such as unexpected changes to /etc/passwd.
• Implement compensating controls, such as SELinux or other mandatory access control mechanisms, to limit the impact of a potential exploit.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record was published on 2026-07-15T13:17:03.933Z and was last modified on 2026-07-16T07:16:47.750Z. The NVD entry is currently Deferred. The vulnerability affects CRI-O, and the fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable. Evidence limits suggest verifying container environment variable settings and reviewing /etc/passwd for unexpected changes.

Official resources