# CVE-2026-62146: CRI-O sandbox state poisoning via pod annotations

Source: https://junglewise.ai/threats/cve-2026-62146-a-trust-boundary-flaw-in-cri-o-s-sandbox-state-persistence-allows  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-62146 · Severity: high · CVSS 7.8 · Published 2026-09-30

CRI-O is a container runtime that manages application isolation on Kubernetes systems. A flaw in how it stores and reloads sandbox metadata allows an attacker with pod-creation privileges to inject malicious annotations that overwrite CRI-O's internal bookkeeping. After a runtime restart, this can expose host-side resources inside containers, enabling container escape and potential compromise of the underlying node.

Technologies: [CRI-O](https://junglewise.ai/threats/technologies/cri-o), [Red Hat OpenShift Container Platform](https://junglewise.ai/threats/technologies/openshift-container-platform-4-12). Vendors: [CRI-O](https://junglewise.ai/threats/vendors/cri-o), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-62146 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62146 being exploited in the wild.

**How severe is CVE-2026-62146?** High severity, with a CVSS score of 7.8, published 30 September 2026.

**Which products and versions are affected?** CRI-O CRI-O; Red Hat OpenShift Container Platform.

**Is there a fix for CVE-2026-62146?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-62146 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-62146?** Check whether you run CRI-O or Red Hat OpenShift Container Platform. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A trust-boundary violation in CRI-O's sandbox state persistence fails to properly validate or namespace untrusted pod annotations and labels before persisting them alongside reserved sandbox metadata. When CRI-O restarts, it reloads this poisoned state as trusted. An attacker with pod-creation access can craft pod metadata that, after a CRI-O restart and container recreate, exposes host-side runtime-management resources (such as sockets under /dev/shm) inside the container, enabling container escape via CWE-501 Trust Boundary Violation.

## Affected products

- CRI-O CRI-O
- Red Hat OpenShift Container Platform

## Timeline

- 2026-09-30: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-62146](https://access.redhat.com/security/cve/CVE-2026-62146)

## Related threats

- [Red Hat OpenShift Agent-Based Installation privilege escalation in CSR approval](https://junglewise.ai/threats/cve-2026-19706-during-abi-bootstrap-the-bootstrap-node-s-approve-csr-service)
- [Ansible Operator Jinja2 template injection](https://junglewise.ai/threats/cve-2026-92982-a-flaw-was-found-in-ansible-operator-plugins-a-low-privileged)
- [CRI-O bind_mount_prefix symlink privilege escalation](https://junglewise.ai/threats/cve-2026-76061-a-flaw-was-found-in-cri-o-s-bind-mount-prefix-handling-when)
- [Red Hat OpenShift console path traversal in locale handler](https://junglewise.ai/threats/cve-2026-75887-a-flaw-was-found-in-the-openshift-console-an-unauthenticated)
- [CRI-O checkpoint restore security context bypass](https://junglewise.ai/threats/cve-2026-92574-a-vulnerability-in-cri-o-checkpoint-restore-allows-a-user-who-can)