A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65838 advisory.

  - crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption (CVE-2025-68121)

  - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318  /etc/passwd Injection via HOME env     (CVE-2026-15809)

  - net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

  - crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building     (CVE-2026-32280)

  - github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON     Web Encryption (JWE) object (CVE-2026-34986)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:66385 advisory.

  - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318  /etc/passwd Injection via HOME env     (CVE-2026-15809)

  - github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON     Web Encryption (JWE) object (CVE-2026-34986)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:65906 advisory.

  - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318  /etc/passwd Injection via HOME env     (CVE-2026-15809)

  - github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON     Web Encryption (JWE) object (CVE-2026-34986)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:62548 advisory.

  - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318  /etc/passwd Injection via HOME env     (CVE-2026-15809)

  - github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON     Web Encryption (JWE) object (CVE-2026-34986)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:60452 advisory.

  - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318  /etc/passwd Injection via HOME env     (CVE-2026-15809)

  - github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON     Web Encryption (JWE) object (CVE-2026-34986)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:60449 advisory.

  - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318  /etc/passwd Injection via HOME env     (CVE-2026-15809)

  - github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON     Web Encryption (JWE) object (CVE-2026-34986)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:60444 advisory.

  - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318  /etc/passwd Injection via HOME env     (CVE-2026-15809)

  - github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON     Web Encryption (JWE) object (CVE-2026-34986)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57361 advisory.

  - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318  /etc/passwd Injection via HOME env     (CVE-2026-15809)

  - golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)

  - mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e58c82fdeb advisory.

    Automatic update for cri-o1.36-1.36.3-1.fc45.

    ##### **Changelog**

    ```
    * Tue Aug  4 2026 Bradley G Smith <bradley.g.smith@gmail.com> - 1.36.3-1
    - Update to release v1.36.3
    - Resolves: rhbz#2510870
    - Resolves  CVE-2026-15809: rhbz#2500983
    - Upstream fixes

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
346921	RHCOS 4 : OpenShift Container Platform 4.13.71 (RHSA-2026:65838)	Nessus	Red Hat Local Security Checks	Local	critical
346912	RHCOS 4 : OpenShift Container Platform 4.18.55 (RHSA-2026:66385)	Nessus	Red Hat Local Security Checks	Local	high
346851	RHCOS 4 : OpenShift Container Platform 4.12.98 (RHSA-2026:65906)	Nessus	Red Hat Local Security Checks	Local	high
344538	RHCOS 4 : OpenShift Container Platform 4.16.70 (RHSA-2026:62548)	Nessus	Red Hat Local Security Checks	Local	high
342488	RHCOS 4 : OpenShift Container Platform 4.19.45 (RHSA-2026:60452)	Nessus	Red Hat Local Security Checks	Local	high
342241	RHCOS 4 : OpenShift Container Platform 4.21.31 (RHSA-2026:60449)	Nessus	Red Hat Local Security Checks	Local	high
342233	RHCOS 4 : OpenShift Container Platform 4.20.36 (RHSA-2026:60444)	Nessus	Red Hat Local Security Checks	Local	high
339452	RHCOS 4 : OpenShift Container Platform 4.22.11 (RHSA-2026:57361)	Nessus	Red Hat Local Security Checks	Local	high
331945	Fedora 45 : cri-o1.36 (2026-e58c82fdeb)	Nessus	Fedora Local Security Checks	Local	high

Detections

Analytics

CVE-2026-15809

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high