7.8
High
CVE-2026-62146 A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite…
Description
A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside the container, enabling container escape.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat OpenShift Container Platform 4.16 | Versions not published | |
| Red Hat OpenShift Container Platform 5 | Versions not published |
Other CVEs of Red Hat OpenShift Container Platform 4
The 630 CVEs of Red Hat OpenShift Container Platform 4 →
CVE-2026-123876
Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation
4.4
Medium
CVE-2026-123037
Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)
6.7
Medium
CVE-2026-82976
Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret
7.1
High
CVE-2026-120831
Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service
6.5
Medium