CVE-2026-17113

Awaiting Analysis Awaiting Analysis - Queue

CRI-O Container Runtime Environment Variable Handling Flaw Leads to DoS

Publication date: 2026-08-24

Last updated on: 2026-08-27

Assigner: redhat-SADP

Description

A flaw was found in CRI-O's container-creation environment-variable handling (`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in `server/container_create.go`). When a `CreateContainer` request supplies a `nil` CRI `Envs` field, CRI-O falls back to using the target OCI image's `config.Env` entries unfiltered, in contrast to the normal merge path, which validates each entry for a `key=value` form before use. An OCI image whose `config.Env` contains an entry with no `=` character (e.g. a bare `NOEQUALS` string) causes CRI-O to split that entry into a single-element slice and then index its second element, which is out of range. This triggers an unrecovered Go runtime panic in the `crio` daemon process, crashing it and terminating the container-runtime service for all workloads on the node until it is restarted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-08-27

Generated

2026-09-14

AI Q&A

2026-08-25

EPSS Evaluated

2026-09-12

NVD

CVE-2026-17113

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	cri-o	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1287	The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

Attack-Flow Graph

Executive Summary

This vulnerability is a flaw in CRI-O's handling of environment variables during container creation. When a container creation request provides a null environment variable field, CRI-O incorrectly uses the image's environment variables without proper validation. If an image contains an environment variable without an equals sign (e.g., NOEQUALS), it causes a runtime panic in the CRI-O daemon, crashing the container-runtime service for all workloads on the node until manually restarted.

Detection Guidance

This vulnerability can be detected by checking if the CRI-O daemon crashes when processing container creation requests with malformed environment variables. Monitor CRI-O logs for panic errors or daemon crashes. Ensure environment variables in container images follow the key=value format. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

This vulnerability can cause unexpected crashes of the CRI-O daemon, leading to downtime for all containers on the affected node. It requires no user interaction beyond a malicious or misconfigured container image being deployed, potentially disrupting services relying on that node.

Compliance Impact

This vulnerability causes a denial-of-service by crashing the CRI-O daemon, which terminates the container runtime service for all workloads on a node. This could disrupt critical operations, potentially leading to service unavailability and data processing interruptions that may violate compliance requirements for availability in standards like GDPR or HIPAA.

Mitigation Strategies

Update CRI-O to the latest patched version to fix the container-creation environment-variable handling flaw. Restart the crio daemon after applying the update to ensure the fix is active.

Hi! I’m here to help you understand CVE-2026-17113. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70