CVE-2026-30892

CVE-2026-30892 is a high-severity privilege escalation vulnerability (CVSS 7.8) affecting crun_project crun versions 1.19 through 1.26. It stems from incorrect parsing of the `crun exec -u` option, where the value '1' is misinterpreted as UID 0 and GID 0, rather than UID 1. This allows a local attacker with low privileges to execute processes with root privileges inside a container, leading to high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this issue. The vulnerability is patched in crun version 1.27.