CVE-2026-17113 Red Hat CVE debrief

Who should care

Defenders responsible for container runtime security, particularly those using CRI-O, should assess exposure and verify CRI-O versions. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that CRI-O is properly configured and up-to-date to prevent potential service disruptions.

Why it matters

Defenders should care about CVE-2026-17113 because it can cause CRI-O daemon process crashes, potentially disrupting container runtime services on a node. This issue requires verification of CRI-O versions and monitoring of daemon process activity to prevent or mitigate potential impacts.

• Potential disruption of container runtime services on a node due to CRI-O daemon process crash
• Need for verification of CRI-O versions and potential updates to prevent service disruption
• Importance of monitoring CRI-O daemon process for unusual activity

Technical summary

The flaw occurs in CRI-O's mergeEnvs function in server/utils.go, which is consumed by setupContainerEnvironmentAndWorkdir in server/container_create.go. When a CreateContainer request provides a nil CRI Envs field, CRI-O uses the target OCI image's config.Env entries without validation. If an OCI image's config.Env contains an entry without a = character, CRI-O will panic when trying to access the second element of the resulting slice.

Defensive priority

Defenders should prioritize verifying and updating CRI-O to prevent potential service disruption.

Recommended defensive actions

• Verify CRI-O version and apply updates if available
• Review container runtime configurations for potential vulnerabilities
• Monitor CRI-O daemon process for unusual activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The issue arises from CRI-O's handling of environment variables during container creation, specifically when a CreateContainer request supplies a nil CRI Envs field. This can lead to a panic in the CRI-O daemon process if the OCI image's config.Env contains an entry without a = character. Defenders should verify CRI-O versions and review container runtime configurations to prevent or mitigate potential impacts. The CVE record was published on 2026-08-24T22:16:50.333Z and has not been modified since then. The official CVE Program

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.