CVE-2026-17113: Cri-o: cri-o: unvalidated image env var causes daemon crash
A flaw was found in CRI-O, the container runtime. Under a specific internal condition, CRI-O skips checking whether a container image's environment variable settings are properly formatted before using them. If an image contains a malformed environment variable, CRI-O crashes while trying to process it.
Other sources
A flaw was found in CRI-O's container-creation environment-variable handling (mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go). When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's config.Env entries unfiltered, in contrast to the normal merge path, which validates each entry for a key=value form before use. An OCI image whose config.Env contains an entry with no = character (e.g. a bare NOEQUALS string) causes CRI-O to split that entry into a single-element slice and then index its second element, which is out of range. This triggers an unrecovered Go runtime panic in the crio daemon process, crashing it and terminating the container-runtime service for all workloads on the node until it is restarted.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the crash?
A CreateContainer request must supply a nil CRI Envs field, and the selected OCI image must contain a config.Env entry without an equals sign, such as a bare NOEQUALS value. Under those conditions, CRI-O processes the malformed image environment entry without the validation used in the normal merge path.
Who can cause impact on a node?
An actor able to cause CRI-O to create a container using a specially formed OCI image can trigger the issue when the request has a nil Envs field. The supplied information does not establish that an unauthenticated or remote actor can do this.
What is the operational impact if exploitation succeeds?
The crio daemon undergoes an unrecovered Go runtime panic and crashes. The container-runtime service stops for all workloads on that node until CRI-O is restarted.
How can operators recognize that a node has been affected?
Affected nodes will have a crashed crio daemon and container-runtime service interruption impacting all workloads on the node. The triggering container creation involves an image config.Env entry lacking an equals sign.