GHSA-xhf5-7wjv-pqxp CVE-2026-53488 GO-2026-5758
containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.18%
- Chance of exploitation in the next 30 days. Higher than 7.13% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- Fix
- Available
- 2 packages have a fixed version
Description
Impact
A bug was found in containerd where the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations.
Patches
This bug has been fixed in the following containerd versions:
- 2.3.2
- 2.2.5
- 2.1.9
- 2.0.10
- 1.7.33
Users should update to these versions to resolve the issue.
Workarounds
Ensure that only trusted images are used.
Credits
The containerd project would like to thank Anthropic Research, in collaboration with Claude, the GKE Security Team using Gemini, and Robert Prast (@robertprast) for independently discovering and responsibly disclosing this issue in accordance with the containerd security policy.
For more information
If you have any questions or comments about this advisory:
- Open an issue in containerd
- Email us at security@containerd.io
To report a security issue in containerd:
- Report a new vulnerability
- Email us at security@containerd.io
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/containerd/containerd | >= 1.7.0, < 1.7.33 |
1.7.33 |
| github.com/containerd/containerd/v2 | >= 2.0.0, < 2.0.10 |
2.0.10 |
| github.com/containerd/containerd/v2 | >= 2.1.0, < 2.1.9 |
2.1.9 |
| github.com/containerd/containerd/v2 | >= 2.2.0, < 2.2.5 |
2.2.5 |
| github.com/containerd/containerd/v2 | >= 2.3.0, < 2.3.2 |
2.3.2 |
| github.com/containerd/containerd/v2 | >= 2.0.0, < 2.0.10>= 2.1.0, < 2.1.9>= 2.2.0, < 2.2.5>= 2.3.0, < 2.3.2 |
2.0.102.1.92.2.52.3.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/containerd/containerd Go → 1.7.33
- go
go get github.com/containerd/containerd@v1.7.33 && go mod tidy
github.com/containerd/containerd/v2 Go → 2.0.10
- go
go get github.com/containerd/containerd/v2@v2.0.10 && go mod tidy
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 8.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
How to prevent it
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-rp3h-jf77-q9p4 containerd: Unpack DoS via repeated opaque whiteouts | Medium | Also affects github.com/containerd/containerd |
| GO-2026-6791 containerd CRI plugin: Checkpoint restore bypasses destination security context | High | Also affects github.com/containerd/containerd |
| GHSA-pg57-6jwg-q645 Containerd has image-pull DoS via crafted OCI index graph amplification | Medium | Also affects github.com/containerd/containerd |
| GHSA-7jxh-36q5-gcqv containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service | Medium | Also affects github.com/containerd/containerd |
| GO-2026-5064 containerd CRI checkpoint restore CDI annotation smuggling | Critical | Also affects github.com/containerd/containerd |
| GO-2026-5622 Arbitrary host CRI log file read via symlink following in CRI checkpoint restore | Medium | Also affects github.com/containerd/containerd |
| GO-2026-5338 containerd: CRI checkpoint import allows local image tag poisoning | Critical | Also affects github.com/containerd/containerd |
| GHSA-jpcc-p29g-p8mq containerd image-triggered runtime DoS via unbounded group parsing | Medium | Also affects github.com/containerd/containerd |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor