Threats Tagged 'cve-2026-15809'

Red Hat OpenShift Container Platform versions including 4.12.98, 4.14, 4.15, 4.16 through 4.17, 4.18 through 4.19, 4.19 through 4.20, 4.20 through 4.21, 4.21 through 4.22, and up to 4.22.11 contain multiple security vulnerabilities. These include a bypass vulnerability in cri-o allowing /etc/passwd injection via the HOME environment variable (CVE-2026-15809), several denial of service issues in Go language packages, a privilege escalation via incorrect Punycode processing, and cross-site scripting in Go's html/template package. Red Hat has released updated RPM packages and container images to address these issues. Users are advised to upgrade to the fixed versions using the OpenShift CLI or web console.

A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.