High severity · published Sep 30, 2026
CVE-2026-62146
Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside the container, enabling container escape.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat OpenShift Container Platform 4.16 · Red Hat
All versions, or not specified · source: vendor
Affected product
RH
Red Hat OpenShift Container Platform 4.16
Red Hat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-62146
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-62146
vdb-entry
https://access.redhat.com/security/cve/CVE-2026-62146
issue-tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2499618
github.com
https://github.com/cri-o/cri-o/security/advisories/GHSA-6wmc-5877-hgc9
More from Red Hat OpenShift Container Platform 4.16
7.8
CVE-2026-46300
net: skbuff: preserve shared-frag marker during coalescing
7.8
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
9.8
CVE-2026-4408
Samba: remote code execution in samr
9.8
CVE-2026-42010
Gnutls: gnutls: authentication bypass via nul character in username
9.8
CVE-2026-43037
ip6_tunnel: clear skb2->cb[] in ip4ip6_err()