Is CVE-2026-62146 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62146 being exploited in the wild.

How severe is CVE-2026-62146?

High severity, with a CVSS score of 7.8, published 30 September 2026.

Which products and versions are affected?

CRI-O CRI-O; Red Hat OpenShift Container Platform.

Is there a fix for CVE-2026-62146?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-62146 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-62146?

Check whether you run CRI-O or Red Hat OpenShift Container Platform. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62146: CRI-O sandbox state poisoning via pod annotations

CVE-2026-62146 · Severity: high · CVSS 7.8 · Published 2026-09-30

CRI-O is a container runtime that manages application isolation on Kubernetes systems. A flaw in how it stores and reloads sandbox metadata allows an attacker with pod-creation privileges to inject malicious annotations that overwrite CRI-O's internal bookkeeping. After a runtime restart, this can expose host-side resources inside containers, enabling container escape and potential compromise of the underlying node.

Technologies: CRI-O, Red Hat OpenShift Container Platform. Vendors: CRI-O, Red Hat.

Quick answers

Is CVE-2026-62146 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62146 being exploited in the wild.
How severe is CVE-2026-62146?: High severity, with a CVSS score of 7.8, published 30 September 2026.
Which products and versions are affected?: CRI-O CRI-O; Red Hat OpenShift Container Platform.
Is there a fix for CVE-2026-62146?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-62146 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-62146?: Check whether you run CRI-O or Red Hat OpenShift Container Platform. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A trust-boundary violation in CRI-O's sandbox state persistence fails to properly validate or namespace untrusted pod annotations and labels before persisting them alongside reserved sandbox metadata. When CRI-O restarts, it reloads this poisoned state as trusted. An attacker with pod-creation access can craft pod metadata that, after a CRI-O restart and container recreate, exposes host-side runtime-management resources (such as sockets under /dev/shm) inside the container, enabling container escape via CWE-501 Trust Boundary Violation.

Affected products

CRI-O CRI-O
Red Hat OpenShift Container Platform

Timeline

2026-09-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.