EUVD-2026-65156Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Local socket access, high privileges to create containers, no confidentiality or integrity impact, but scope change because the panic kills all node workloads.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in CRI-O's container-creation environment-variable handling (mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/container_create.go). When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's config.Env entries unfiltered, in contrast to the normal merge path, which validates each entry for a key=value form before use. An OCI image whose config.Env contains an entry with no = character (e.g. a bare NOEQUALS string) causes CRI-O to split that entry into a single-element slice and then index its second element, which is out of range. This triggers an unrecovered Go runtime panic in the crio daemon process, crashing it and terminating the container-runtime service for all workloads on the node until it is restarted.
AnalysisAI
CRI-O's container-creation code path crashes the daemon with an unrecovered Go runtime panic when processing an OCI image whose config.Env contains a malformed entry lacking an '=' character, under the specific condition that the CreateContainer request supplies a nil CRI Envs field. The crash terminates the crio daemon process, disrupting all container workloads on the affected node until the service is manually restarted - a node-wide denial of service. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three simultaneous conditions: (1) the attacker must have high-privilege access (PR:H) sufficient to submit CreateContainer requests to CRI-O, typically cluster-admin or equivalent pod-scheduling rights in OpenShift; (2) the CreateContainer gRPC request must carry a nil CRI Envs field, triggering the unvalidated fallback path rather than the normal merge path that performs key=value validation; (3) the OCI image referenced in that request must have at least one entry in its config.Env that lacks an '=' character. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 6.0 (AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) correctly captures several key risk-limiting factors. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the patch released by Red Hat for OpenShift Container Platform 4, referenced at https://access.redhat.com/security/cve/CVE-2026-17113. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Privilege escalation in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform allows a com
HAProxy configuration injection in Red Hat OpenShift Container Platform 4 allows a low-privileged tenant with permission
Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated
Identity header smuggling in OpenShift Container Platform 4.x allows authenticated low-privilege users to escalate privi
Credential theft in Red Hat OpenShift Container Platform's Windows Machine Config Operator (WMCO) allows adjacent-networ
Information disclosure and denial of service in GnuTLS (libgnutls) let a remote, unauthenticated attacker trigger a heap
Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon proces
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today