Skip to content
Fencer Intel
high 7.8

CVE-2026-15809 json

Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env

published 3mo ago modified 7d ago also EUVD-2026-44661

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits
0
none known

Summary

A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.

Patch / fix

  • Red Hat Red Hat OpenShift Container Platform 4.12 0:1.25.5-36.rhaos4.12.git2e7f657.el8
  • Red Hat Red Hat OpenShift Container Platform 4.13 0:1.26.5-32.rhaos4.13.git1088e36.el8
  • Red Hat Red Hat OpenShift Container Platform 4.14 0:1.27.8-22.rhaos4.14.git0633bf1.el8
  • Red Hat Red Hat OpenShift Container Platform 4.15 0:1.28.11-17.rhaos4.15.git48e6ddb.el8
  • Red Hat Red Hat OpenShift Container Platform 4.16 0:1.29.13-14.rhaos4.16.git84cfdc6.el8
  • Red Hat Red Hat OpenShift Container Platform 4.17 0:1.30.14-13.rhaos4.17.git3a25d98.el8
  • Red Hat Red Hat OpenShift Container Platform 4.18 0:1.31.13-14.rhaos4.18.gitf2de9ac.el8
  • Red Hat Red Hat OpenShift Container Platform 4.19 0:1.32.13-11.rhaos4.19.git089e95c.el9
  • Red Hat Red Hat OpenShift Container Platform 4.20 0:1.33.13-5.rhaos4.20.git7ebc848.el9
  • Red Hat Red Hat OpenShift Container Platform 4.21 0:1.34.11-4.rhaos4.21.git358c4b4.el9
  • Red Hat Red Hat OpenShift Container Platform 4.22 0:1.35.6-5.rhaos4.22.git41f610b.el9
  • cri-o openshift 4.17 1.30.14-13.rhaos4.17.git3a25d98.el8
  • cri-o openshift 4.17 1.30.14-13.rhaos4.17.git3a25d98.el9
  • cri-tools openshift 4.17 1.30.0-10.el8
  • cri-tools openshift 4.17 1.30.0-10.el9
  • openshift openshift 4.17 4.17.0-202609081428.p2.g4e295fa.assembly.stream.el8
  • openshift openshift 4.17 4.17.0-202609081428.p2.g4e295fa.assembly.stream.el9
  • openshift-clients openshift 4.17 4.17.0-202609081428.p2.g7189593.assembly.stream.el8
  • openshift-clients openshift 4.17 4.17.0-202609081428.p2.g7189593.assembly.stream.el9

red hat advisories RHSA-2026:70585RHSA-2026:67856RHSA-2026:67836RHSA-2026:66385RHSA-2026:65838RHSA-2026:65906

Is CVE-2026-15809 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-15809 updated cvss 7.8

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

  • Red Hat Confidential Compute Attestation openshift-sandboxed-containers/osc-monitor-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4 openshift4/cnf-tests-rhel8, openshift4/ztp-site-generate-rhel8
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 5 cri-o 1.35.5-2.rhaos4.22.git78f87e5.el9
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4.12 cri-o 1.25.5-36.rhaos4.12.git2e7f657.el8
    fixed: vendor fix RHSA-2026:65906
  • Red Hat OpenShift Container Platform 4.13 cri-o 1.26.5-32.rhaos4.13.git1088e36.el8, cri-o 1.26.5-32.rhaos4.13.git1088e36.el9
    fixed: vendor fix RHSA-2026:65838
  • Red Hat OpenShift Container Platform 4.14 cri-o 1.27.8-22.rhaos4.14.git0633bf1.el8, cri-o 1.27.8-22.rhaos4.14.git0633bf1.el9
    fixed: vendor fix RHSA-2026:67836
  • Red Hat OpenShift Container Platform 4.15 cri-o 1.28.11-17.rhaos4.15.git48e6ddb.el8, cri-o 1.28.11-17.rhaos4.15.git48e6ddb.el9
    fixed: vendor fix RHSA-2026:67856
  • Red Hat OpenShift Container Platform 4.16 cri-o 1.29.13-14.rhaos4.16.git84cfdc6.el8, cri-o 1.29.13-14.rhaos4.16.git84cfdc6.el9
    fixed: vendor fix RHSA-2026:62548
show 7 more
  • Red Hat OpenShift Container Platform 4.17 cri-o 1.30.14-13.rhaos4.17.git3a25d98.el8, cri-o 1.30.14-13.rhaos4.17.git3a25d98.el9
    fixed: vendor fix RHSA-2026:70585
  • Red Hat OpenShift Container Platform 4.18 cri-o 1.31.13-14.rhaos4.18.gitf2de9ac.el8, cri-o 1.31.13-14.rhaos4.18.gitf2de9ac.el9
    fixed: vendor fix RHSA-2026:66385
  • Red Hat OpenShift Container Platform 4.19 cri-o 1.32.13-11.rhaos4.19.git089e95c.el9
    fixed: vendor fix RHSA-2026:60452
  • Red Hat OpenShift Container Platform 4.20 cri-o 1.33.13-5.rhaos4.20.git7ebc848.el9
    fixed: vendor fix RHSA-2026:60444
  • Red Hat OpenShift Container Platform 4.21 cri-o 1.34.11-4.rhaos4.21.git358c4b4.el9
    fixed: vendor fix RHSA-2026:60449
  • Red Hat OpenShift Container Platform 4.22 cri-o 1.35.6-5.rhaos4.22.git41f610b.el9
    fixed: vendor fix RHSA-2026:57361
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.22 python-setuptools-rust 1.9.0-2.el9ocp, python3.12-setuptools-rust 1.9.0-2.el9ocp Red Hat OpenShift Container Platform 4.13 cri-tools 1.26.0-9.el8, cri-tools 1.26.0-9.el9, perf 5.14.0-284.191.1.el9_2, rtla 5.14.0-284.191.1.el9_2, bpftool 7.0.0-284.191.1.el9_2, kernel 5.14.0-284.191.1.el9_2, +81 more Red Hat OpenShift Container Platform 4.14 cri-tools 1.27.0-9.el8, cri-tools 1.27.0-9.el9, perf 5.14.0-284.192.1.el9_2, rtla 5.14.0-284.192.1.el9_2, bpftool 7.0.0-284.192.1.el9_2, kernel 5.14.0-284.192.1.el9_2, +80 more Red Hat OpenShift Container Platform 4.15 cri-tools 1.28.0-10.el8, cri-tools 1.28.0-10.el9, openshift 4.15.0-202609111416.p2.g5cb2ef4.assembly.stream.el8, openshift 4.15.0-202609111416.p2.g5cb2ef4.assembly.stream.el9, openshift-clients 4.15.0-202609111416.p2.g8231637.assembly.stream.el8, openshift-clients 4.15.0-202609111416.p2.g8231637.assembly.stream.el9, +10 more Red Hat OpenShift Container Platform 4.16 openshift-clients 4.16.0-202608211840.p2.g33afbae.assembly.stream.el8, openshift-clients 4.16.0-202608211840.p2.g33afbae.assembly.stream.el9, openshift-clients-redistributable 4.16.0-202608211840.p2.g33afbae.assembly.stream.el8, openshift-clients-redistributable 4.16.0-202608211840.p2.g33afbae.assembly.stream.el9 Red Hat OpenShift Container Platform 4.17 cri-tools 1.30.0-10.el8, cri-tools 1.30.0-10.el9, openshift 4.17.0-202609081428.p2.g4e295fa.assembly.stream.el8, openshift 4.17.0-202609081428.p2.g4e295fa.assembly.stream.el9, openshift-clients 4.17.0-202609081428.p2.g7189593.assembly.stream.el8, openshift-clients 4.17.0-202609081428.p2.g7189593.assembly.stream.el9, +18 more
    +3 more products
    Red Hat OpenShift Container Platform 4.18 openshift-clients 4.18.0-202608191253.p2.g3da7a06.assembly.stream.el8, openshift-clients 4.18.0-202608191253.p2.g3da7a06.assembly.stream.el9, openshift-clients-redistributable 4.18.0-202608191253.p2.g3da7a06.assembly.stream.el8, openshift-clients-redistributable 4.18.0-202608191253.p2.g3da7a06.assembly.stream.el9 Red Hat OpenShift Container Platform 4.20 cri-tools 1.33.0-4.el9, runc 1.2.9-4.rhaos4.20.el9, butane 0.25.1-4.rhaos4.20.el8, podman 5.4.0-17.rhaos4.20.el9, podman-tests 5.4.0-17.rhaos4.20.el9, podman-docker 5.4.0-17.rhaos4.20.el9, +21 more Red Hat OpenShift Container Platform 4.22 cri-tools 1.35.0-3.el9, runc 1.4.0-4.rhaos4.22.el9, kata-containers 3.31.0-5.rhaos4.22.el9, openshift 4.22.0-202608190726.p2.g05744ab.assembly.stream.el8, openshift 4.22.0-202608190726.p2.g05744ab.assembly.stream.el9, openshift-clients 4.22.0-202608131626.p2.g7ec2e14.assembly.stream.el8, +15 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
3mo ago

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Red Hat OpenShift Container Platform 4.13
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenShift Container Platform 4.22
  • Red Hat Confidential Compute Attestation
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Container Platform 5

Classification

Weakness
  • CWE-134 Use of Externally-Controlled Format String
  • CWE-116 Improper Encoding or Escaping of Output

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.