CVE-2026-15809: Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env
A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.
Other sources
The fix for CVE-2022-4318 in CRI-O is incorrect and has been bypassable since it was introduced on December 14, 2022. The check in server/containercreate.go uses a Go raw string literal (\n) instead of an interpreted string literal ("\n"), causing it to search for the literal two-character sequence backslash-n (0x5c 0x6e) rather than an actual newline character (0x0a).
An attacker who can set environment variables on a container (via the CRI CreateContainer request) can supply a real newline character in the HOME environment variable, bypassing the check entirely. The unsanitized value is then passed to utils.GeneratePasswd, which uses fmt.Sprintf to construct the container's /etc/passwd content, allowing arbitrary line injection.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
github.com/cri-o/cri-oto a version that resolves this vulnerability.Patch fix bypass for cve-2022-4318 — /etc/passwd injection via home env - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2022-4318
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15809?
CVE-2026-15809 has a high severity score of 7.8.
What is CVE-2026-15809 about?
CVE-2026-15809 involves a flaw in CRI-O that allows for injection of a newline character into the HOME environment variable, bypassing a previous fix.
How can CVE-2026-15809 be exploited?
An attacker who can set environment variables on a container can exploit CVE-2026-15809 to inject malicious content into the /etc/passwd file.
How do I fix CVE-2026-15809?
Fixing CVE-2026-15809 involves updating to the latest version of CRI-O that addresses this vulnerability.
Who is affected by CVE-2026-15809?
Users of CRI-O are at risk if they do not apply the necessary updates to mitigate CVE-2026-15809.