{"id":"CVE-2026-62146","aliases":[],"title":"Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket","titleSource":"redhat","descriptionSource":"redhat","products":[{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.16","platforms":[],"versions":[{"version":"0:1.29.13-16.rhaos4.16.git84cfdc6.el8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-62146"}],"remediation":[{"text":"There is no complete workaround; until a fix is available, administrators should restrict who can create/update pods and set arbitrary annotations via RBAC/admission policy, minimize unnecessary CRI-O restarts or node reboots and monitor for anomalous container mounts (e.g. under /dev/shm) following runtime restarts, then apply the vendor patch once released.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-62146"}],"description":"A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside the container, enabling container escape.","severity":"high","score":7.8,"published":"2026-09-30T11:49:20.363Z","modified":"2026-10-27T21:55:15.622Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://access.redhat.com/errata/RHSA-2026:89713","https://access.redhat.com/security/cve/CVE-2026-62146","https://bugzilla.redhat.com/show_bug.cgi?id=2499618","https://github.com/cri-o/cri-o/security/advisories/GHSA-6wmc-5877-hgc9"],"sources":[{"name":"CVE","id":"CVE-2026-62146","modified":"2026-10-27T21:55:15.622Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-62146"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","score":7.8}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T21:30:35.328Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}