CVE-2026-17113
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
CRI-O has a vulnerability in environment-variable handling during container creation. When a CreateContainer request has a nil Envs field, CRI-O uses unfiltered config.Env entries from the OCI image, which can cause a Go panic and crash the crio daemon. This occurs when an entry lacks '='.
Risk Assessment
The risk includes remote attackers causing the crio daemon to crash, stopping all containers on the node and disrupting services.
Recommendation
Update CRI-O to a patched version and restrict running containers from OCI images with invalid config.Env entries.
Other vulnerabilities in CRI-O
See all- CVE-2026-15809High
A flaw was found in CRI-O where the fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME variable, enabling arbitrary lines to be added to /etc/passwd.
- CVE-2025-4437Medium
There's a vulnerability in the CRI-O application where when a container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause high memory consumption leading applications to be killed due to out-of-memory. As a result a denial-of-service can be achieved, possibly disrupting other pods and services running on the same host.
- CVE-2024-5154High
A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.
Original NVD description (English source)
A flaw was found in CRI-O's container-creation environment-variable handling (`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in `server/container_create.go`). When a `CreateContainer` request supplies a `nil` CRI `Envs` field, CRI-O falls back to using the target OCI image's `config.Env` entries unfiltered, in contrast to the normal merge path, which validates each entry for a `key=value` form before use. An OCI image whose `config.Env` contains an entry with no `=` character (e.g. a bare `NOEQUALS` string) causes CRI-O to split that entry into a single-element slice and then index its second element, which is out of range. This triggers an unrecovered Go runtime panic in the `crio` daemon process, crashing it and terminating the container-runtime service for all workloads on the node until it is restarted.