Vulnerability · Published Sep 30, 2026 · Assigned by redhat

CVE-2026-62146Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket

High 7.8

In plain English

A high-severity security flaw in Red Hat OpenShift Container Platform 4.16 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 93.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside the container, enabling container escape.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat OpenShift Container Platform 4.16	see references
Red Hat	Red Hat OpenShift Container Platform 5	see references

Weakness: CWE-501 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References

RHSA-2026:89713 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-62146 vdb-entry, x_refsource_REDHAT
RHBZ#2499618 issue-tracking, x_refsource_REDHAT
https://github.com/cri-o/cri-o/security/advisories/GHSA-6wmc-5877-hgc9