A flaw was found in CRI-O's container-creation environment-variable handling (`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in `server/container_create.go`). When a `CreateContainer` request supplies a `nil` CRI `Envs` field, CRI-O falls back to using the target OCI image's `config.Env` entries unfiltered, in contrast to the normal merge path, which validates each entry for a `key=value` form before use. An OCI image whose `config.Env` contains an entry with no `=` character (e.g. a bare `NOEQUALS` string) causes CRI-O to split that entry into a single-element slice and then index its second element, which is out of range. This triggers an unrecovered Go runtime panic in the `crio` daemon process, crashing it and terminating the container-runtime service for all workloads on the node until it is restarted.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-77abfa2cdd advisory.

    - Update to release v1.36.6
    - Resolves: rhbz#2537559
    - Resolves CVE-2026-17113: rhbz#2523493
    - Resolves: rhbz#2540885

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0025579bc9 advisory.

    - Update to release v1.36.6
    - Resolves: rhbz#2537559
    - Resolves CVE-2026-17113: rhbz#2523493
    - Resolves: rhbz#2540885

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f5c88f763a advisory.

    - Update to release v1.36.6
    - Resolves: rhbz#2537559
    - Resolves CVE-2026-17113: rhbz#2523493
    - Resolves: rhbz#2540885

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 46 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-05f65b07d7 advisory.

    Automatic update for cri-o1.36-1.36.6-1.fc46.

    ##### **Changelog**

    ```
    * Sun Sep 27 2026 Bradley G Smith <bradley.g.smith@gmail.com> - 1.36.6-1
    - Update to release v1.36.6
    - Resolves: rhbz#2537559
    - Resolves CVE-2026-17113: rhbz#2523493
    - Resolves: rhbz#2540885
    * Sun Sep 27 2026 Bradley G Smith <bradley.g.smith@gmail.com> - 1.36.5-2
    - Define --pinns_path
    - pinns_path is set to the libexec path for pinns

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
363022	Fedora 45 : cri-o1.36 (2026-77abfa2cdd)	Nessus	Fedora Local Security Checks	Local	medium
362929	Fedora 43 : cri-o1.36 (2026-0025579bc9)	Nessus	Fedora Local Security Checks	Local	medium
362928	Fedora 44 : cri-o1.36 (2026-f5c88f763a)	Nessus	Fedora Local Security Checks	Local	medium
350855	Fedora 46 : cri-o1.36 (2026-05f65b07d7)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-17113

medium

Tenable Plugins

medium

medium

medium

medium