VDB

CVE-2026-15809

CVE-2026-15809 PUBLISHED CVSS 7.8 HIGH

Reported by redhat · Published July 15, 2026

A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.

Risk Scores

CVSS 3.1
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
Red HatRed Hat OpenShift Container Platform 4.120:1.25.5-36.rhaos4.12.git2e7f657.el8
Red HatRed Hat OpenShift Container Platform 4.130:1.26.5-32.rhaos4.13.git1088e36.el8
Red HatRed Hat OpenShift Container Platform 4.140:1.27.8-22.rhaos4.14.git0633bf1.el8
Red HatRed Hat OpenShift Container Platform 4.150:1.28.11-17.rhaos4.15.git48e6ddb.el8
Red HatRed Hat OpenShift Container Platform 4.160:1.29.13-14.rhaos4.16.git84cfdc6.el8
Red HatRed Hat OpenShift Container Platform 4.170:1.30.14-13.rhaos4.17.git3a25d98.el8
Red HatRed Hat OpenShift Container Platform 4.180:1.31.13-14.rhaos4.18.gitf2de9ac.el8
Red HatRed Hat OpenShift Container Platform 4.190:1.32.13-11.rhaos4.19.git089e95c.el9
Red HatRed Hat OpenShift Container Platform 4.200:1.33.13-5.rhaos4.20.git7ebc848.el9
Red HatRed Hat OpenShift Container Platform 4.210:1.34.11-4.rhaos4.21.git358c4b4.el9
Red HatRed Hat OpenShift Container Platform 4.220:1.35.6-5.rhaos4.22.git41f610b.el9
Red HatConfidential Compute Attestation
Red HatRed Hat OpenShift Container Platform 4
Red HatRed Hat OpenShift Container Platform 4
Red HatRed Hat OpenShift Container Platform 5
Red HatRed Hat OpenShift Container Platform 4.140:1.27.8-22.rhaos4.14.git0633bf1.el8
Red HatRed Hat OpenShift Container Platform 4.210:1.34.11-4.rhaos4.21.git358c4b4.el9
Red HatRed Hat OpenShift Container Platform 4.180:1.31.13-14.rhaos4.18.gitf2de9ac.el8
Red HatRed Hat OpenShift Container Platform 5
Red HatRed Hat OpenShift Container Platform 4.120:1.25.5-36.rhaos4.12.git2e7f657.el8

…and 11 more

Timeline

  • Jul 15, 2026 Coalition ESS Score
  • Jul 15, 2026 CVE Published
  • Aug 7, 2026 EPSS Score
  • Aug 24, 2026 EPSS Score
  • Aug 25, 2026 Distribution Patch
  • Aug 25, 2026 Security Advisory
  • Aug 30, 2026 EPSS Score
  • Sep 2, 2026 Distribution Patch
  • Sep 2, 2026 Security Advisory
  • Sep 2, 2026 Distribution Patch
  • Sep 2, 2026 Security Advisory
  • Sep 3, 2026 Distribution Patch

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›