CVE-2026-62146
Raw vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-62146 is a high-severity Trust Boundary Violation (CWE-501) vulnerability. Its CVSS base score is 7.8 (High).
Operationally, ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-16 (Security and Privacy Attributes) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-89789
Vulnerability Data
A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside…
more
the container, enabling container escape.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Associating explicit security attributes with data objects enables enforcement mechanisms that keep trust levels from being mixed inside structures.
Information flow enforcement directly stops trusted and untrusted data from being combined by applying rules that govern allowable data movements and combinations.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Documented data-flow representations make trust boundaries explicit and help surface mixing of trusted/untrusted data.
Logical segmentation and access controls enforce separation between trust domains, reducing the chance of co-mingled data structures.
Secure-development practices (coding standards, reviews, validation) directly prevent mixing trusted and untrusted data inside the same structures.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle mandates separation of trusted and untrusted data flows, directly preventing mixing in the same structure.
Application security requirements include explicit trust-boundary definitions and data classification at interfaces.
Secure architecture principles require explicit trust zones and data segregation, mitigating mixing of trusted/untrusted data.
Secure coding standards can enforce input validation and data tagging, but do not guarantee architectural separation.