CVE-2026-15809

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Jul 15, 2026
Source updated: Oct 1, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env

A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Red Hat OpenShift Container Platform 4.12

Vendor: Red Hat
Product: Red Hat OpenShift Container Platform 4.12
Platforms: Unknown
Default status: affected
Package: cri-o
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat OpenShift Container Platform 4.12 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:1.25.5-36.rhaos4.12.git2e7f657.el8	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift Container Platform 4.13

Vendor: Red Hat
Product: Red Hat OpenShift Container Platform 4.13
Platforms: Unknown
Default status: affected
Package: cri-o
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat OpenShift Container Platform 4.13 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:1.26.5-32.rhaos4.13.git1088e36.el8	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift Container Platform 4.14

Vendor: Red Hat
Product: Red Hat OpenShift Container Platform 4.14
Platforms: Unknown
Default status: affected
Package: cri-o
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat OpenShift Container Platform 4.14 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:1.27.8-22.rhaos4.14.git0633bf1.el8	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift Container Platform 4.15

Vendor: Red Hat
Product: Red Hat OpenShift Container Platform 4.15
Platforms: Unknown
Default status: affected
Package: cri-o
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat OpenShift Container Platform 4.15 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:1.28.11-17.rhaos4.15.git48e6ddb.el8	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift Container Platform 4.16

Vendor: Red Hat
Product: Red Hat OpenShift Container Platform 4.16
Platforms: Unknown
Default status: affected
Package: cri-o
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat OpenShift Container Platform 4.16 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:1.29.13-14.rhaos4.16.git84cfdc6.el8	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift Container Platform 4.17

Vendor: Red Hat
Product: Red Hat OpenShift Container Platform 4.17
Platforms: Unknown
Default status: affected
Package: cri-o
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat OpenShift Container Platform 4.17 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:1.30.14-13.rhaos4.17.git3a25d98.el8	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift Container Platform 4.18

Vendor: Red Hat
Product: Red Hat OpenShift Container Platform 4.18
Platforms: Unknown
Default status: affected
Package: cri-o
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat OpenShift Container Platform 4.18 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:1.31.13-14.rhaos4.18.gitf2de9ac.el8	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift Container Platform 4.19

Vendor: Red Hat
Product: Red Hat OpenShift Container Platform 4.19
Platforms: Unknown
Default status: affected
Package: cri-o
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat OpenShift Container Platform 4.19 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:1.32.13-11.rhaos4.19.git089e95c.el9	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift Container Platform 4.20

Vendor: Red Hat
Product: Red Hat OpenShift Container Platform 4.20
Platforms: Unknown
Default status: affected
Package: cri-o
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat OpenShift Container Platform 4.20 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:1.33.13-5.rhaos4.20.git7ebc848.el9	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift Container Platform 4.21

Vendor: Red Hat
Product: Red Hat OpenShift Container Platform 4.21
Platforms: Unknown
Default status: affected
Package: cri-o
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat OpenShift Container Platform 4.21 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:1.34.11-4.rhaos4.21.git358c4b4.el9	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift Container Platform 4.22

Vendor: Red Hat
Product: Red Hat OpenShift Container Platform 4.22
Platforms: Unknown
Default status: affected
Package: cri-o
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat OpenShift Container Platform 4.22 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:1.35.6-5.rhaos4.22.git41f610b.el9	`unaffected`	rpm	*	Unavailable	None listed

Confidential Compute Attestation

Vendor: Red Hat
Product: Confidential Compute Attestation
Platforms: Unknown
Default status: affected
Package: openshift-sandboxed-containers/osc-monitor-rhel9
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat OpenShift Container Platform 4

Vendor: Red Hat
Product: Red Hat OpenShift Container Platform 4
Platforms: Unknown
Default status: affected
Package: openshift4/cnf-tests-rhel8
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat OpenShift Container Platform 4

Vendor: Red Hat
Product: Red Hat OpenShift Container Platform 4
Platforms: Unknown
Default status: affected
Package: openshift4/ztp-site-generate-rhel8
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.