What’s Vulnerable › Vulnerabilities

CVE-2026-17113: Cri-o: cri-o: unvalidated image env var causes daemon crash

• Severity: medium (CVSS 6.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-24 · updated 2026-10-21
• Weakness: CWE-1287

Description

A flaw was found in CRI-O's container-creation environment-variable handling (`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in `server/container_create.go`). When a `CreateContainer` request supplies a `nil` CRI `Envs` field, CRI-O falls back to using the target OCI image's `config.Env` entries unfiltered, in contrast to the normal merge path, which validates each entry for a `key=value` form before use. An OCI image whose `config.Env` contains an entry with no `=` character (e.g. a bare `NOEQUALS` string) causes CRI-O to split that entry into a single-element slice and then index its second element, which is out of range. This triggers an unrecovered Go runtime panic in the `crio` daemon process, crashing it and terminating the container-runtime service for all workloads on the node until it is restarted.

Affected products

• Red Hat OpenShift Container Platform 4.18: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-17113
• https://bugzilla.redhat.com/show_bug.cgi?id=2506872

Get alerted when CVE-2026-17113 or the next vulnerability affects your stack