Description
A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside the container, enabling container escape.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | cri-o | 1.29.13-16.rhaos4.16.git84cfdc6.el8 | RHSA-2026:89713 |
| Red Hat OpenShift 4 | cri-tools | 1.29.0-10.el8 | RHSA-2026:89713 |
| Red Hat OpenShift 4 | ignition +1 | 2.18.0-9.rhaos4.16.el9 | RHSA-2026:89713 |
| Red Hat OpenShift 4 | openshift +5 | 4.16.0-202610221642.p2.g41c4e9b.assembly.stream.el8 | RHSA-2026:89713 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.16.0-202610221642.p2.gcb89b60.assembly.stream.el8 | RHSA-2026:89713 |
| Red Hat OpenShift 4 | ose-aws-ecr-image-credential-provider | 4.16.0-202610221642.p2.gd39ac87.assembly.stream.el8 | RHSA-2026:89713 |
| Red Hat OpenShift 4 | ose-azure-acr-image-credential-provider | 4.16.0-202610221642.p2.g90fa18b.assembly.stream.el8 | RHSA-2026:89713 |
| Red Hat OpenShift 4 | ose-gcp-gcr-image-credential-provider | 4.16.0-202610221642.p2.g26b43df.assembly.stream.el8 | RHSA-2026:89713 |
| Red Hat OpenShift 4 | skopeo +1 | 2:1.14.5-9.rhaos4.16.el8 | RHSA-2026:89713 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cri-o | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
TeamN4C/SG-2026-0026 ★ 0 · Oct 1, 2026
CVE-2026-62146 CRI-O ShmPath poisoning PoC and exploit
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- RHSA-2026:89713 Red Hat Security Advisory: OpenShift Container Platform 4.16.74 packages and security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
References
- RHSA-2026:89713 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-62146 vdb-entry
- RHBZ#2499618 issue-tracking
- https://github.com/cri-o/cri-o/security/advisories/GHSA-6wmc-5877-hgc9