Skip to main content

Containerd CVE-2025-47290

HIGH
Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
2025-05-20 security-advisories@github.com
Information Disclosure Red Hat Suse Containerd Linuxfoundation
7.6
CVSS 4.0 · GitHub Advisory
View

Vulnerability Assessment

Weakness
CWE
CWE-367
OWASP Top 10:2025
A04:2021 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture TOCTOU prevention
Impact

CVSS score of 7.6 (HIGH). Attack characteristics: network attack vector, low complexity, no privileges required, user interaction required. EPSS exploitation probability: 0.06%.
Exploit ScenarioDerived

This vulnerability can be exploited remotely over the network. Successful exploitation could compromise the high-severity affected system.
This Month Plan within 30 days. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 28, 2026

containerd is a container runtime. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affected Packages

go github.com/containerd/containerd/v2 fix: 2.1.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in go

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified under CWE-367. containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only affected version of containerd is 2.1.0. Other versions of containerd are not affected. This bug has been fixed in containerd 2.1.1. Users should update to this version to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images. Affected products include: Linuxfoundation Containerd.

Know when Containerd gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 7.6 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U
SUSE 5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Red Hat 8.4 HIGH

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
Active
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
High
Subsequent system: Confidentiality
High
Subsequent system: Integrity
High
Subsequent system: Availability
High

Lifecycle Timeline

2
Patch released
Mar 28, 2026 - 18:42 nvd
Patch available
CVE Published
May 20, 2025 - 19:15 nvd
HIGH 7.6

DescriptionGitHub Advisory

containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only affected version of containerd is 2.1.0. Other versions of containerd are not affected. This bug has been fixed in containerd 2.1.1. Users should update to this version to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

Executive ViewAI

Why It Matters

Organizations using containerd face notable risk from CVE-2025-47290 rated CVSS 7.6. Exploitation could compromise the security of affected deployments. A patch is available and should be applied as part of regular vulnerability management.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score
0.1%
Top 80% exploitable

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)GitHub Advisory

cpe:2.3:a:linuxfoundation:containerd:2.1.0:*:*:*:*:*:*:*

More in Containerd

View all
CVE-2023-25173 HIGH POC
7.8 Feb 16

containerd is an open source container runtime. Rated high severity (CVSS 7.8), this vulnerability is low attack complex
CVE-2022-23648 HIGH POC
7.5 Mar 03

containerd is a container runtime available as a daemon for Linux and Windows. Rated high severity (CVSS 7.5), this vuln
CVE-2026-53493 MEDIUM POC
6.9 Sep 25

Denial of service in containerd versions prior to 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 allows an unauthenticated atta
CVE-2026-53488 CRITICAL
9.4 Jun 19

Host command execution in containerd's CRI plugin arises because labels from an image config (Dockerfile LABEL instructi
CVE-2026-47218 CRITICAL
9.3 Oct 15

Native code execution inside the shim zygote process is possible in runwasi's containerd-shim-wasmtime-v1 prior to 0.6.1
CVE-2026-53492 HIGH
8.4 Jun 19

Kubernetes device-plugin and resource-allocation enforcement can be bypassed in containerd by a namespace user holding p
CVE-2026-53489 HIGH
8.2 Jun 19

Arbitrary host file disclosure in containerd's CRI plugin lets an attacker read any file on the Kubernetes node via `kub
CVE-2026-95837 HIGH
7.8 Oct 12

Privilege escalation in containerd's CRI checkpoint-restore path allows an authenticated local attacker who can submit a
CVE-2021-41103 HIGH
7.8 Oct 04

containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. Rated high se
CVE-2026-107446 MEDIUM
6.8 Oct 08

Integer overflow in containerd overlaybd's LSMT index loader (do_load_index) lets a crafted, untrusted overlaybd blob pu
CVE-2022-23471 MEDIUM
6.5 Dec 07

containerd is an open source container runtime. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploit
CVE-2021-32760 MEDIUM
6.3 Jul 19

containerd is a container runtime. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no auth

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

View all
CVE-2024-30088 HIGH POC
7.0
CVE-2025-22224 CRITICAL
9.3
CVE-2025-38352 HIGH POC
7.8
CVE-2023-35311 HIGH
8.8
CVE-2022-48618 HIGH
7.0
CVE-2023-38146 HIGH POC
8.8
CVE-2025-34027 CRITICAL POC
10.0
CVE-2020-1337 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Server 16.0 Fixed
openSUSE Tumbleweed Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed

References

Advisories & patches
PATCH https://github.com/containerd/containerd/commit/cada13298fba85493badb6fecb6ccf80e49673cc ADVISORY https://github.com/containerd/containerd/security/advisories/GHSA-cm76-qm8v-3j95 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:15146/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:15159/ REF https://github.com/containerd/containerd/releases/tag/v2.1.1

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy