github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.36 packages and security update

Red Hat OpenShift Container Platform release 4.20.36 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

RHCOS 4 : OpenShift Container Platform 4.20.36 (RHSA-2026:60444)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:60444 advisory. - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 /etc/passwd Injection via HOME env CVE-2026-15809 -...

RHCOS 4 : OpenShift Container Platform 4.21.31 (RHSA-2026:60449)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:60449 advisory. - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 /etc/passwd Injection via HOME env CVE-2026-15809 -...

PT-2026-84120

В свежем релизе cri-o исправили две уязвимости, одна из которых имеет критический уровень и может привести к побегу из контейнера. CVE-2026-62146 позволяет пользователю с правом создавать Pods отравить сохранённое состояние sandbox через произвольные annotations, а после рестарта CRI-O или...

AZL-98256 CVE-2026-37236 affecting package cri-o 1.30.1-1

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.11 packages and security update

Red Hat OpenShift Container Platform release 4.22.11 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

RHCOS 4 : OpenShift Container Platform 4.22.11 (RHSA-2026:57361)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57361 advisory. - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 /etc/passwd Injection via HOME env CVE-2026-15809 - golang: Go os.Root:...

CVE-2026-17113

A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...

AZL-97649 CVE-2026-17113 affecting package cri-o 1.30.1-1

A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...

CVE-2026-17113

A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...

CVE-2026-17113 Cri-o: cri-o: unvalidated image env var causes daemon crash

A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...

CVE-2026-17113 Cri-o: cri-o: unvalidated image env var causes daemon crash

A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...

CVE-2026-17113

CRI-O is vulnerable in its container-creation environment-variable handling (mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/container_create.go). When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to the target OCI image's confi...

CVE-2026-17113

A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...

PT-2026-81044

Name of the Vulnerable Software and Affected Versions CRI-O affected versions not specified Description A flaw exists in the container-creation environment-variable handling within the mergeEnvs function located in server/utils.go and used by setupContainerEnvironmentAndWorkdir in server/containe...

GO-2026-6238 vulnerabilities

Vulnerabilities for packages: virt-handler, rke2-runtime, cosmo-router-fips, splunk-otel-collector-fips, witness, rke2-runtime-fips, agentbeat-fips, kuma, prometheus, kubescape-server, containerd-fips, vitess, opentelemetry-ebpf-instrumentation, milvus, envoy-gateway, docker, cosmo-router, gitaly...

CVE-2026-10722 vulnerabilities

Vulnerabilities for packages: virt-handler, rke2-runtime, cosmo-router-fips, splunk-otel-collector-fips, witness, rke2-runtime-fips, agentbeat-fips, kuma, prometheus, kubescape-server, containerd-fips, vitess, opentelemetry-ebpf-instrumentation, milvus, envoy-gateway, docker, cosmo-router, gitaly...