CVE-2026-62146

7.8 HIGHpublic exploit available

Published 2026-09-30 · Updated 2026-09-30

AI risk analysis

Summary: This flaw in CRI-O's sandbox state persistence allows attackers to overwrite reserved sandbox bookkeeping, potentially leading to container escape and exposure of host-side resources.
Exploitability: Exploitation requires attacker-influenced pod metadata and access to the pod's sandbox state; the difficulty depends on the attacker's ability to manipulate metadata.
Blast radius: If exploited, this flaw could allow attackers to escape the container and access sensitive host-side resources, significantly impacting system security.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to the latest version of CRI-O, specifically version 1.24.4 or later, as detailed in the vendor advisory.

rcecontainer-escapepersistence

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside the container, enabling container escape.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-501

Public exploit & PoC references

https://github.com/cri-o/cri-o/security/advisories/GHSA-6wmc-5877-hgc9

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.