SB20260825119 - Multiple vulnerabilities in CRI-O

Description

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error (CVE-ID: CVE-2026-17113)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper input validation in CRI-O daemon when processing a crafted OCI image with a malformed environment variable entry. A local privileged user can supply a specially crafted OCI image to cause a denial of service.

This only occurs when no environment variables are set in the container spec, and the normal Kubernetes API path does not trigger the issue.

2) Improper access control (CVE-ID: CVE-2026-62146)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to escape a container and access the CRI-O socket.

The vulnerability exists due to improper access control in persisted CRI-O sandbox state when recreating containers after a CRI-O restart or node reboot. A remote user can create a pod with arbitrary annotations to poison sandbox state and access the CRI-O socket.

Exploitation requires the ability to create a pod with arbitrary annotations, and the issue is triggered after a CRI-O restart or node reboot when containers are recreated in the affected sandbox.

Remediation

Install update from vendor's website.

References

• https://github.com/cri-o/cri-o/security/advisories/GHSA-v5pw-cc82-qrf6
• https://github.com/cri-o/cri-o/security/advisories/GHSA-6wmc-5877-hgc9