Description
A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | — | — |
| Red Hat | Confidential Compute Attestation | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | containernetworking-plugins | 1:1.4.0-8.rhaos4.13.el8 | RHSA-2026:65838 |
| Red Hat OpenShift 4 | cri-o | 1.25.5-36.rhaos4.12.git2e7f657.el8 | RHSA-2026:70585, RHSA-2026:67856, RHSA-2026:67836 |
| Red Hat OpenShift 4 | cri-tools | 1.26.0-9.el8 | RHSA-2026:70585, RHSA-2026:65838, RHSA-2026:57361 |
| Red Hat OpenShift 4 | openshift +1 | 4.13.0-202608122150.p2.gbbc7c0c.assembly.stream.el8 | RHSA-2026:70585, RHSA-2026:65838, RHSA-2026:57361 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.13.0-202608122150.p2.gd192e90.assembly.stream.el8 | RHSA-2026:70585, RHSA-2026:65838, RHSA-2026:57361 |
| Red Hat OpenShift 4 | openshift-kubelet +3 | 4.17.0-202609081428.p2.g4e295fa.assembly.stream.el8 | RHSA-2026:70585, RHSA-2026:57361 |
| Red Hat OpenShift 4 | ose-aws-ecr-image-credential-provider | 4.17.0-202609190230.p2.gb0a5486.assembly.stream.el8 | RHSA-2026:70585, RHSA-2026:57361 |
| Red Hat OpenShift 4 | ose-azure-acr-image-credential-provider | 4.17.0-202609081428.p2.g5bcfbfd.assembly.stream.el8 | RHSA-2026:70585, RHSA-2026:57361 |
| Red Hat OpenShift 4 | ose-gcp-gcr-image-credential-provider | 4.17.0-202609081428.p2.g8ce997d.assembly.stream.el8 | RHSA-2026:70585, RHSA-2026:57361 |
| Red Hat OpenShift 4 | skopeo +1 | 2:1.11.3-7.rhaos4.13.el8 | RHSA-2026:65838 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cri-o | No fix yet | — |
Advisories 11
- RHSA-2026:70585 Red Hat Security Advisory: OpenShift Container Platform 4.17.58 packages and security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:65838 Red Hat Security Advisory: OpenShift Container Platform 4.13.71 packages and security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:57361 Red Hat Security Advisory: OpenShift Container Platform 4.22.11 packages and security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:67856 Red Hat Security Advisory: OpenShift Container Platform 4.15.69 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:67836 Red Hat Security Advisory: OpenShift Container Platform 4.14.74 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:66385 Red Hat Security Advisory: OpenShift Container Platform 4.18.55 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:65906 Red Hat Security Advisory: OpenShift Container Platform 4.12.98 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:62548 Red Hat Security Advisory: OpenShift Container Platform 4.16.70 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:60449 Red Hat Security Advisory: OpenShift Container Platform 4.21.31 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:60452 Red Hat Security Advisory: OpenShift Container Platform 4.19.45 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:60444 Red Hat Security Advisory: OpenShift Container Platform 4.20.36 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
References
- RHSA-2026:57361 vendor-advisory
- RHSA-2026:60444 vendor-advisory
- RHSA-2026:60449 vendor-advisory
- RHSA-2026:60452 vendor-advisory
- RHSA-2026:62548 vendor-advisory
- RHSA-2026:65838 vendor-advisory
- RHSA-2026:65906 vendor-advisory
- RHSA-2026:66385 vendor-advisory
- RHSA-2026:67836 vendor-advisory
- RHSA-2026:67856 vendor-advisory
- RHSA-2026:70585 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-15809 vdb-entry
- RHBZ#2500846 issue-tracking
- https://github.com/cri-o/cri-o/pull/6450
- https://github.com/cri-o/cri-o/pull/6524