CRI-O: Sandbox state poisoning via pod annotations may expose runtime socket

Summary

A trust-boundary flaw in CRI-O's sandbox state persistence lets attacker-influenced pod annotations or labels overwrite CRI-O's reserved sandbox bookkeeping. After a CRI-O restart or node reboot, a later container recreate in that sandbox can expose a host-side runtime-management socket inside the container, which may enable container escape. Exploitation requires the ability to create or update pods, plus a restart and container recreate, and the attack complexity is high.

Affected

• Red Hat OpenShift Container Platform 4.16 (CRI-O 1.29.x packages; the vendor lists affected versions as before 1.29.13-16.rhaos4.16.git84cfdc6.el8 per the CVE record)
• Red Hat OpenShift Container Platform 5 (listed as affected by default)
• Upstream CRI-O versions that persist reserved sandbox metadata with untrusted annotations and reload it as trusted (exact upstream ranges unknown)

Fixed in

• Red Hat OpenShift Container Platform 4.16: RHSA-2026:89713 (OpenShift Container Platform 4.16.74 RPM packages, cri-o-1.29.13-16.rhaos4.16.git84cfdc6)
• Upstream: backports reported in v1.34.12 and in release-1.25 and release-1.32 branches
• Other distributions and branches: Unknown.

Workaround

• No complete workaround exists.
• Restrict who can create or update pods and who can set arbitrary annotations, using RBAC or admission policies.
• Minimize unnecessary CRI-O restarts and node reboots.
• Monitor for anomalous container mounts (for example under /dev/shm) after runtime restarts.

Exploitation

• No evidence of exploitation found.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• No public proof of concept reported by one tracker.
• Known exploited status: Unverified.

Our recommendation

• Verify where CRI-O runs in your environment (OpenShift, RKE2, managed Kubernetes nodes, RHEL with cri-o).
• Apply the vendor patch, such as RHSA-2026:89713 for OpenShift 4.16, through your official update channel.
• Until patched, restrict pod creation and annotation rights and monitor for unexpected mounts after restarts.
• Prioritise clusters with multi-tenant or untrusted workloads and CI runners that run untrusted images.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  TeamN4C/SG-2026-0026

Research sources

• Red Hat CVE record CVE-2026-62146 access.redhat.com
• Red Hat Errata RHSA-2026:89713 access.redhat.com
• Red Hat Bugzilla 2499618 bugzilla.redhat.com
• GitHub Security Advisory GHSA-6wmc-5877-hgc9 github.com
• CRI-O upstream fix pull request 10403 github.com
• CRI-O backport pull request 10408 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 07:34.