600 matches found
CVE-2026-17113
A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...
CVE-2026-17113 Cri-o: cri-o: unvalidated image env var causes daemon crash
A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...
CVE-2026-17113
CRI-O is vulnerable in its container-creation environment-variable handling (mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/container_create.go). When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to the target OCI image's confi...
CVE-2026-17113
A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...
PT-2026-81044
Name of the Vulnerable Software and Affected Versions CRI-O affected versions not specified Description A flaw exists in the container-creation environment-variable handling within the mergeEnvs function located in server/utils.go and used by setupContainerEnvironmentAndWorkdir in server/containe...
GO-2026-6238 vulnerabilities
Vulnerabilities for packages: gitaly-fips, milvus, agentbeat, cilium, cilium-fips, delve, docker, elastic-agent, elastic-agent-fips, hubble, beats-fips, gitaly, k3s, containerd, cosmo-router-fips, docker-fips, envoy-gateway-fips, kubescape-operator-fips, rke2-runtime-fips, rke2-runtime, witness,...
GO-2025-3748 vulnerabilities
Vulnerabilities for packages: ipfs-cluster-fips, k3s...
GO-2026-5527 vulnerabilities
Vulnerabilities for packages: argo-workflows, argo-workflows-fips, kubeflow-pipelines-fips, kubeflow-pipelines-driver-fips, kubeflow-pipelines...
SUSE CVE-2026-13622
A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths using net.Dial without symlink protection. These socket paths reside in qemu-owned directories...
[SECURITY] Fedora 44 Update: cri-o1.34-1.34.11-1.fc44
Open Container Initiative-based implementation of Kubernetes Container Runtime Interface...
Fedora 43 : cri-o1.34 (2026-7e85920dc5)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7e85920dc5 advisory. - Update to release v1.34.11 - Resolves: rhbz2510870 - Resolves CVE-2026-34986: rhbz2455652 - Upstream fixes Tenable has extracted the preceding description...
EUVD-2026-57615
A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths using net.Dial without symlink protection. These socket paths reside in qemu-owned directories...
CVE-2026-13622
A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths using net.Dial without symlink protection. These socket paths reside in qemu-owned directories...
CVE-2026-13622
A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths using net.Dial without symlink protection. These socket paths reside in qemu-owned directories...
Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code
A flaw was found in the SPDY streaming code used by Kubelet, CRI-O, and kube-apiserver. An attacker with specific cluster roles, such as those allowing access to pod port forwarding, execution, or attachment, or node proxying, could exploit this vulnerability. This could lead to a Denial of Servi...
Important: Red Hat Security Advisory: Red Hat build of MicroShift 4.19.42 security update
Red Hat build of MicroShift release 4.19.42 is now available with updates to packages and images that include a security update. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...
Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code
A flaw was found in the SPDY streaming code used by Kubelet, CRI-O, and kube-apiserver. An attacker with specific cluster roles, such as those allowing access to pod port forwarding, execution, or attachment, or node proxying, could exploit this vulnerability. This could lead to a Denial of Servi...
CVE-2026-15809
A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...
CVE-2026-15809 Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env
A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...
CVE-2026-15809 Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env
A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...