Skip to main content

Containerd CVE-2025-47290

HIGH
Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
2025-05-20 security-advisories@github.com
Information Disclosure Containerd Red Hat Suse
7.6
CVSS 4.0 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
7.6 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Red Hat
8.4 HIGH
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

3
Analysis Generated
Mar 28, 2026 - 18:42 vuln.today
Patch released
Mar 28, 2026 - 18:42 nvd
Patch available
CVE Published
May 20, 2025 - 19:15 nvd
HIGH 7.6

DescriptionGitHub Advisory

containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only affected version of containerd is 2.1.0. Other versions of containerd are not affected. This bug has been fixed in containerd 2.1.1. Users should update to this version to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

AnalysisAI

containerd is a container runtime. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-367. containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only affected version of containerd is 2.1.0. Other versions of containerd are not affected. This bug has been fixed in containerd 2.1.1. Users should update to this version to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images. Affected products include: Linuxfoundation Containerd.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Containerd

View all
CVE-2023-25173 HIGH POC
7.8 Feb 16

containerd is an open source container runtime. Rated high severity (CVSS 7.8), this vulnerability is low attack complex
CVE-2022-23648 HIGH POC
7.5 Mar 03

containerd is a container runtime available as a daemon for Linux and Windows. Rated high severity (CVSS 7.5), this vuln
CVE-2026-53488 CRITICAL
9.4 Jun 19

Host command execution in containerd's CRI plugin arises because labels from an image config (Dockerfile LABEL instructi
CVE-2026-53492 HIGH
8.4 Jun 19

Kubernetes device-plugin and resource-allocation enforcement can be bypassed in containerd by a namespace user holding p
CVE-2026-53489 HIGH
8.2 Jun 19

Arbitrary host file disclosure in containerd's CRI plugin lets an attacker read any file on the Kubernetes node via `kub
CVE-2021-41103 HIGH
7.8 Oct 04

containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. Rated high se
CVE-2022-23471 MEDIUM
6.5 Dec 07

containerd is an open source container runtime. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploit
CVE-2021-32760 MEDIUM
6.3 Jul 19

containerd is a container runtime. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no auth
CVE-2021-21334 MEDIUM
6.3 Mar 10

In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through con
CVE-2020-15157 MEDIUM
6.1 Oct 16

In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability
CVE-2026-50195 MEDIUM
5.6 Jun 19

Checkpoint image poisoning in containerd's CRI implementation allows an attacker with pod-creation permissions to corrup
CVE-2023-25153 MEDIUM
5.5 Feb 16

containerd is an open source container runtime. Rated medium severity (CVSS 5.5), this vulnerability is no authenticatio

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

View all
CVE-2024-30088 HIGH POC
7.0
CVE-2025-22224 CRITICAL
9.3
CVE-2025-38352 HIGH POC
7.8
CVE-2022-48618 HIGH
7.0
CVE-2023-38146 HIGH POC
8.8
CVE-2025-34027 CRITICAL POC
10.0
CVE-2020-1337 HIGH POC
7.8
CVE-2026-25641 CRITICAL POC
10.0

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Server 16.0 Fixed
openSUSE Tumbleweed Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed

Share

CVE-2025-47290 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy