Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-17113— Cri-o: cri-o: unvalidated image env var causes daemon crash

Quick assessment

Affected
Red Hat Red Hat OpenShift Container Platform 4
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

发现 CRI-O 容器创建过程中处理环境变量（具体为 中的 函数，该函数被 中的 调用）存在缺陷。当 请求中提供空的 CRI 字段时，CRI-O 会回退到使用目标 OCI 镜像配置中的 条目，且不进行过滤。而正常合并路径会在使用前验证每个条目是否符合 格式。如果 OCI 镜像的 中包含不含 字符的条目（例如裸字符串 ），CRI-O 会将该条目拆分为只含一个元素的切片，随后尝试访问其第二个元素，导致越界索引。这会触发 守护进程进程中未捕获的 Go 运行时 panic，导致进程崩溃，并使节点上所有工作负载的容器运行时服

CVSS 6.0 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-17113

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cri-o: cri-o: unvalidated image env var causes daemon crash
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in CRI-O's container-creation environment-variable handling (`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in `server/container_create.go`). When a `CreateContainer` request supplies a `nil` CRI `Envs` field, CRI-O falls back to using the target OCI image's `config.Env` entries unfiltered, in contrast to the normal merge path, which validates each entry for a `key=value` form before use. An OCI image whose `config.Env` contains an entry with no `=` character (e.g. a bare `NOEQUALS` string) causes CRI-O to split that entry into a single-element slice and then index its second element, which is out of range. This triggers an unrecovered Go runtime panic in the `crio` daemon process, crashing it and terminating the container-runtime service for all workloads on the node until it is restarted.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1287
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4

II. Public POCs for CVE-2026-17113

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-17113

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-17113 (1)

Other References for CVE-2026-17113 (1)

Same Patch Batch · Red Hat · 2026-08-24 · 6 CVEs total

CVE-2026-71366 7.7 HIGH Awx: notification backends allow ssrf and credential leakage
CVE-2026-71364 7.2 HIGH Awx: project archive extraction allows path traversal file writes
CVE-2026-19685 7.1 HIGH Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user rest
CVE-2026-78367 7.0 HIGH Rpm: rpmbuild gettarspec() crafted tar member name → macro injection
CVE-2026-78323 6.5 MEDIUM Jss: jss: jsstrustmanager does not verify nss trust flags on ca certificates

IV. Related Vulnerabilities

Same product: Red Hat OpenShift Container Platform 4
Same vendor: Red Hat
Same weakness: CWE-1287

V. Comments for CVE-2026-17113

No comments yet

Leave a comment