CVE-2026-15809: Use of Externally-Controlled Format String in Red Hat Red Hat OpenShift Container Platform 4.12

This vulnerability in CRI-O, used by Red Hat Confidential Compute Attestation, involves an externally-controlled format string issue (CWE-116). An attacker capable of setting environment variables on a container can inject newline characters into the HOME environment variable, enabling the insertion of arbitrary lines into /etc/passwd. This occurs because the previous fix for CVE-2022-4318 was insufficient and could be bypassed. The vulnerability has a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating a high impact on confidentiality, integrity, and availability. No explicit patch or remediation level is stated in the advisory, and no known exploits in the wild have been reported as of the publication date.

Successful exploitation allows an attacker with limited privileges (ability to set environment variables in a container) to inject arbitrary lines into the /etc/passwd file, potentially leading to privilege escalation, unauthorized access, and system compromise. The vulnerability affects confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15809 for current remediation guidance. Since no official fix or remediation level is stated, users should monitor the vendor advisory for updates and apply any forthcoming patches promptly. Until a fix is available, restrict the ability to set environment variables in containers to trusted users only.