CVE-2026-17113 in OpenShift Container Platform
Summary
by MITRE • 08/24/2026
A flaw was found in CRI-O's container-creation environment-variable handling (`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in `server/container_create.go`). When a `CreateContainer` request supplies a `nil` CRI `Envs` field, CRI-O falls back to using the target OCI image's `config.Env` entries unfiltered, in contrast to the normal merge path, which validates each entry for a `key=value` form before use. An OCI image whose `config.Env` contains an entry with no `=` character (e.g. a bare `NOEQUALS` string) causes CRI-O to split that entry into a single-element slice and then index its second element, which is out of range. This triggers an unrecovered Go runtime panic in the `crio` daemon process, crashing it and terminating the container-runtime service for all workloads on the node until it is restarted.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified within CRI-O represents a critical denial-of-service condition stemming from improper input validation during the environment variable processing phase of container creation. Specifically, the flaw resides in the mergeEnvs function located in server/utils.go, which is invoked by setupContainerEnvironmentAndWorkdir in server/container_create.go when handling CreateContainer requests. Under normal operational circumstances, CRI-O validates each environment variable entry to ensure it adheres to a strict key=value format before integrating it into the container's configuration. This validation step acts as a safeguard against malformed inputs that could lead to unexpected behavior or security breaches. However, this protective mechanism is bypassed when the CreateContainer request supplies a nil value for the CRI Envs field. In such scenarios, CRI-O defaults to using the environment variable entries defined in the target OCI image's config.Env without applying the standard filtering and validation logic that characterizes the normal merge path.
This deviation from the expected processing flow creates a dangerous edge case when interacting with OCI images that contain malformed environment variables. If an OCI image includes an entry in its config.Env field that lacks an equals sign, such as a bare string like NOEQUALS without any associated value, the subsequent parsing logic fails to handle this anomaly correctly. The code attempts to split the entry based on the delimiter and then immediately indexes into the second element of the resulting slice to extract the variable's value. Since entries lacking an equals sign result in a single-element slice after splitting, accessing the index for the second element results in an out-of-bounds array access error. This specific programming error triggers an unrecovered panic within the Go runtime environment, causing immediate termination of the crio daemon process on the affected node.
The operational impact of this vulnerability is severe and widespread across any infrastructure relying on CRI-O as its container runtime. Because the crash occurs at the level of the core daemon responsible for managing containers, a single malicious or misconfigured request can bring down the entire service instance. This results in a complete denial-of-service condition where all workloads running on that node are abruptly terminated and cannot be restarted until the CRI-O process is manually restarted by an administrator. The lack of automatic recovery mechanisms means that system availability is compromised, potentially leading to significant downtime for critical applications hosted on the affected infrastructure.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the software fails to adequately verify environment variable formats before processing them in specific code paths. It also relates to CWE-189 Integer Overflow or Wraparound and CWE-787 Out-of-bounds Write due to the improper indexing of array elements based on untrusted input derived from image configurations. In terms of attack vectors, this flaw can be exploited via ATT&CK technique T1496 Resource Hijacking if used for denial-of-service purposes, although it is primarily a stability issue rather than one leading directly to privilege escalation or data exfiltration in its current manifestation.
Mitigation strategies should focus on ensuring that all code paths handling environment variables enforce consistent validation rules regardless of the source of those variables. Developers must implement robust error checking and bounds verification before accessing array elements derived from split operations. Additionally, implementing panic recovery mechanisms within critical daemon loops can prevent a single malformed request from crashing the entire service, thereby improving resilience against such programming errors. Administrators should also audit their container images to ensure that environment variable definitions strictly adhere to standard key=value formats, although this is not a substitute for fixing the underlying code defect in CRI-O itself.