Description

A flaw was found in CRI-O's container-creation environment-variable handling (`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in `server/container_create.go`). When a `CreateContainer` request supplies a `nil` CRI `Envs` field, CRI-O falls back to using the target OCI image's `config.Env` entries unfiltered, in contrast to the normal merge path, which validates each entry for a `key=value` form before use. An OCI image whose `config.Env` contains an entry with no `=` character (e.g. a bare `NOEQUALS` string) causes CRI-O to split that entry into a single-element slice and then index its second element, which is out of range. This triggers an unrecovered Go runtime panic in the `crio` daemon process, crashing it and terminating the container-runtime service for all workloads on the node until it is restarted.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.0",
  "pubDate": "2026-08-24T22:16:50.333Z",
  "pubdate": "2026-08-24T22:16:50.333Z",
  "executiveSummary": "A denial of service vulnerability exists in CRI-O related to container-creation environment-variable handling.\nThe vulnerability is triggered when a CreateContainer request supplies a nil CRI Envs field, causing CRI-O to bypass normal validation and use the target OCI image's config.Env entries unfiltered.\nSpecifically, an OCI image containing a malformed environment variable entry without an equals sign causes an unrecovered Go runtime panic in the crio daemon process.\nThis crash terminates the container-runtime service for all workloads hosted on the affected node until the service is manually or automatically restarted.\nThe flaw impacts the availability of the container runtime environment, potentially affecting orchestration platforms relying on CRI-O.\nAttack requirements include the ability to supply or specify a malicious or malformed OCI image and issue a CreateContainer request that triggers the insecure environment variable fallback path.",
  "technicalDetails": "The vulnerability resides within CRI-O's container-creation environment-variable handling logic, specifically in the mergeEnvs function located in server/utils.go, which is consumed by setupContainerEnvironmentAndWorkdir in server/container_create.go.\nUnder normal execution paths, CRI-O validates each environment variable entry to ensure it strictly conforms to a key=value format before utilizing it within the container configuration.\nHowever, when a CreateContainer request provides a nil CRI Envs field, the application falls back to processing the target OCI image's config.Env entries without applying this validation.\nIf an OCI image contains an entry lacking an equals character (such as a bare NOEQUALS string), the parsing logic attempts to split the entry.\nThis split operation results in a single-element slice instead of the expected key-value pair representation.\nSubsequent execution attempts to index the second element of this slice (index 1), which is out of range.\nThis out-of-bounds index access triggers an unrecovered Go runtime panic within the crio daemon process.\nThe unhandled panic immediately crashes the crio daemon, terminating the container-runtime service across the entire node and disrupting all running and scheduled container workloads until the service daemon is restarted.\nAuthentication, privilege requirements, and network exposure depend on the local container runtime API access permissions required to issue CreateContainer requests or deploy untrusted OCI images."
}