CVE-2026-84042
crun: crun: rootful krun with passt executes container payload as host root
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 10, 2026
Updated · November 5, 2026
Description
A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29
Statement
This issue is a regression in crun 1.29 and requires the krun handler with passt networking.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
Do not run untrusted images with krun and passt until a fixed crun is released.
CVSS / CWE
CVSS 3.1 · 7.8CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-269 · Improper Privilege Management