CPE
A trust-boundary vulnerability in CRI-O allows an attacker to manipulate pod metadata to overwrite sandbox bookkeeping, enabling container escape via host-side resource mounting upon container recreation.