GHSA-4vg2-xjqj-7chj: Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation

Q: Which deployments are affected?

crun versions 1.19 through 1.26 are affected. Version 1.27 patches the issue.

Q: What is required to trigger the privilege escalation?

The issue is triggered when `crun exec` is invoked with `-u 1` or `--user 1`. That value is parsed as UID 0 and GID 0, causing the executed process to run with higher privileges than intended.

Q: How can I determine whether a process may have been affected?

Review uses of `crun exec` in affected versions for commands that specify `-u 1` or `--user 1`. Those commands may have run the process as UID 0 and GID 0 rather than UID 1 and GID 0.

Q: What should be done if an immediate upgrade is not possible?

Avoid invoking `crun exec` with `-u 1` or `--user 1` until crun can be upgraded to version 1.27 or later.

Published Mar 25, 2026

Updated

crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the crun exec option -u (--user) is incorrectly parsed. The value 1 is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.

Affected Software

1 affected component

Crun crun>=1.19<=1.26

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade crun to a version that resolves this vulnerability.
Fixed in 1.27

Event History

Mar 25, 2026

CVE Published

via OSV·11:57 PM

Data Sourced

via OSV·11:57 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

crun versions 1.19 through 1.26 are affected. Version 1.27 patches the issue.

What is required to trigger the privilege escalation?

The issue is triggered when `crun exec` is invoked with `-u 1` or `--user 1`. That value is parsed as UID 0 and GID 0, causing the executed process to run with higher privileges than intended.

How can I determine whether a process may have been affected?

Review uses of `crun exec` in affected versions for commands that specify `-u 1` or `--user 1`. Those commands may have run the process as UID 0 and GID 0 rather than UID 1 and GID 0.

What should be done if an immediate upgrade is not possible?

Avoid invoking `crun exec` with `-u 1` or `--user 1` until crun can be upgraded to version 1.27 or later.

GHSA-4vg2-xjqj-7chj: Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What is required to trigger the privilege escalation?

How can I determine whether a process may have been affected?

What should be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What is required to trigger the privilege escalation?

How can I determine whether a process may have been affected?

What should be done if an immediate upgrade is not possible?