CVE-2026-17113

Name of the Vulnerable Software and Affected Versions CRI-O (affected versions not specified)

Description A flaw exists in the container-creation environment-variable handling within the mergeEnvs function (located in server/utils.go and used by setupContainerEnvironmentAndWorkdir in server/container create.go). When a CreateContainer request provides a nil CRI Envs field, the system uses the target OCI image's config.Env entries without filtering. If an OCI image contains an entry in config.Env that lacks an equals sign (e.g., a bare string), the system attempts to index a second element that does not exist. This results in an unrecovered Go runtime panic, causing the crio daemon to crash and terminating the container-runtime service for all workloads on the node.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.