Flaw in CRI-O Container-creation Environment-variable Handling
CVE-2026-17113

6MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Openshift Container Platform 4
Vendor
CVE Published:
24 August 2026

What is CVE-2026-17113?

A flaw exists in CRI-O's handling of environment variables during container creation. Specifically, when a CreateContainer request includes a nil Envs field, CRI-O defaults to unfiltered entries from the target OCI image's config.Env. This can lead to a scenario where an entry lacking an = character triggers a panic in the crio daemon process, resulting in an unexpected crash that halts the container-runtime service for all workloads on the node until service is manually restarted. This vulnerability highlights the need for stringent validation of environment variables in container orchestration.

References

https://access.redhat.com/security/cve/CVE-2026-17113
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2506872
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Arpit Jain for reporting this issue.
.