Skip to main content

containerd CVE-2026-53488

| EUVDEUVD-2026-40860 CRITICAL
Improper Input Validation (CWE-20)
2026-06-19 GHSA-xhf5-7wjv-pqxp
Information Disclosure Red Hat Containerd Linuxfoundation
9.4
CVSS 4.0 · Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft image with malicious LABEL (binary:// payload)
  2. Delivery
    Get image pulled/run on target node
  3. Exploit
    CRI plugin propagates label unvalidated to container
  4. Execution
    restart-monitor consumes label as binary:// logger
  5. Persist
    Execute arbitrary command as host root
  6. Impact
    Compromise node / escape container

Vulnerability Assessment

Weakness
CWE
CWE-20
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions

Exploitation requires two concrete prerequisites: (1) a malicious container image must be pulled and run on the affected node - its OCI image config must carry a crafted LABEL value (set via the Dockerfile LABEL instruction); and (2) the node's containerd CRI setup must include a plugin that consumes container labels for operations, specifically the restart-monitor path that maps a label to a binary:// logger URI which is executed. Limiting factors: the CVSS vector is Local (AV:L), so the attacker cannot trigger this purely over the network - a malicious image must reach and run on the host, typically requiring the ability to deploy a workload or influence which images are pulled; and the label-consuming plugin configuration is not universal, so nodes without such a plugin are not exploitable through this path. Environments that strictly run only trusted, signed images from a controlled registry effectively remove the attacker's delivery channel.
Impact

The vendor CVSS 4.0 score is 9.4 (critical) with vector AV:L/AC:L/AT:N/PR:N/UI:N and full high impact to both the vulnerable system (VC/VI/VA:H) and subsequent systems (SC/SI/SA:H), reflecting a container-to-host escape. Notably the attack vector is Local (AV:L), not Network - consistent with the requirement that a malicious image actually be run on the node - which tempers the 'remote' reading some might infer from the critical score. Two signals are missing: no EPSS probability was provided and there is no KEV listing, so no evidence of active or automated exploitation exists yet; treat this as a pre-exploitation, high-impact issue whose realistic reach depends on whether untrusted images are permitted and whether a label-consuming plugin (e.g., restart-monitor with binary:// logging) is actually configured. A data conflict to flag: the intelligence Tags label this 'Information Disclosure,' but the advisory and CWE describe arbitrary host command execution (integrity/availability, not merely confidentiality) - the tag understates the true impact and should be disregarded in favor of the RCE characterization.
Exploit ScenarioDerived

An attacker publishes (or convinces a victim to pull) a container image whose Dockerfile contains a crafted LABEL whose value encodes a binary:// command; when the image is run on a node whose CRI restart-monitor plugin consumes that label, containerd executes the attacker's command as host root, escaping the container. In a multi-tenant Kubernetes cluster, a tenant permitted to schedule pods with arbitrary image references could weaponize this to compromise the node. No public proof-of-concept is available at time of analysis, and the Local attack vector plus low complexity mean exploitation is straightforward once a malicious image is actually executed on a vulnerable, label-consuming configuration.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 01, 2026

Host command execution in containerd's CRI plugin arises because labels from an image config (Dockerfile LABEL instruction) are propagated to the created container without validation; when a downstream plugin consumes those labels for operations (notably the restart-monitor's binary:// logger path), an attacker-controlled label value becomes an arbitrary command executed with host-root privileges. Affected releases are all containerd versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5, and 2.3.2, meaning any environment that pulls and runs an untrusted image on a node using a label-consuming plugin is exposed to full container-to-host escape. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, so this is a high-severity, responsibly-disclosed flaw rather than one with confirmed active exploitation.

Earlier versions of this analysis (2)
v2 Jul 01, 2026 - 02:28 cvss changed CVSS 9.4

Host command execution in containerd's CRI plugin arises because image config labels (the Dockerfile LABEL instruction) are propagated to the created container without validation, so a crafted image can inject values that a label-consuming plugin later executes on the host. Any environment running containerd prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, or 2.0.10 that pulls untrusted images and pairs the CRI runtime with a plugin acting on container labels is affected. No public exploit identified at time of analysis, and the issue is not on the CISA KEV list; a vendor patch is available.

v1 Jun 19, 2026 - 02:19

Unvalidated label propagation in containerd's CRI plugin allows arbitrary host command execution when a label-consuming plugin is active. The CRI plugin copies LABEL instructions from a container image's Dockerfile configuration directly into the running container's metadata without any sanitization, and any containerd plugin that reads these labels to perform host-level operations will process the attacker-controlled values verbatim. Affected containerd versions span four release branches (1.7.x, 2.0.x, 2.1.x, 2.2.x, 2.3.x); no public exploit or CISA KEV listing is identified at time of analysis.

RemediationAI

Vendor-released patches exist - upgrade containerd to the fixed release for your branch: 1.7.33, 2.0.10, 2.1.9, 2.2.5, or 2.3.2 (per GHSA-xhf5-7wjv-pqxp, https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp). On Ubuntu, apply the packaged updates from USN-8471-1/USN-8472-1/USN-8473-1 (https://ubuntu.com/security/notices/USN-8472-1). Where immediate patching is not possible, the vendor-recommended workaround is to ensure only trusted images are used - enforce this concretely by restricting pulls to a curated internal registry, requiring signed images (e.g., Sigstore/cosign admission policy), and blocking arbitrary public-registry pulls; the trade-off is added registry/admission-control overhead and friction for developers who previously pulled arbitrary images. As a defense-in-depth measure until patched, avoid configuring label-consuming plugins such as the restart-monitor with a binary:// logger on untrusted-workload nodes, accepting the loss of that logging/monitoring capability.

Affected VersionsENISA

containerd < 1.7.33
containerd 2.1.0, < 2.1.9
containerd 2.2.0, < 2.2.5
containerd 2.0.0, < 2.0.10
containerd 2.3.0, < 2.3.2

Affected Packages

go github.com/containerd/containerd fix: 1.7.33
go github.com/containerd/containerd/v2 fix: 2.0.10, 2.1.9, 2.2.5, 2.3.2
euvd containerd fix: 1.7.33, 2.0.10, 2.1.9, 2.2.5, 2.3.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in go, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

containerd is the CNCF-graduated container runtime that underpins Kubernetes (via the CRI plugin) and Docker. The root cause is CWE-20 (Improper Input Validation): the CRI plugin copies OCI image-config LABEL key/values verbatim onto the container object, trusting attacker-influenced image metadata. Certain containerd subsystems interpret label values as operational parameters - the GHSA specifically calls out the restart-monitor consuming a label that maps to a binary:// logger URI, where the label value is treated as a command/binary path and executed on the host. Because the untrusted data crosses from the container's image metadata into a host-side execution primitive, a crafted image LABEL yields command execution in the host root context. Affected Go modules are github.com/containerd/containerd (1.7.x branch) and github.com/containerd/containerd/v2 (2.0-2.2 branches); no CPE strings were supplied, so affected scope is derived from the package advisory ranges.

Know when Containerd gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 9.4 CRITICAL
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
vuln.today AI 7.8 HIGH

AV:L because a malicious image must run on the host; AC:H and PR:L because a label-consuming plugin must be configured and the attacker needs workload-deployment ability; S:C for container-to-host escape with full impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE 8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Red Hat 8.8 HIGH

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Local
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
High
Subsequent system: Confidentiality
High
Subsequent system: Integrity
High
Subsequent system: Availability
High

Lifecycle Timeline

3
Analysis Updated
Jul 01, 2026 - 02:28 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 01, 2026 - 02:28 vuln.today
v2 - CVSS changed
CVSS changed
Jul 01, 2026 - 02:22 NVD
9.4 (CRITICAL)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 4

News 4 New Kubernetes Vulnerabilities - 3 Critical, 1 High Severity Jun 20, 2026 News 6 New Docker Vulnerabilities - 3 Critical, 3 High Severity Jun 20, 2026 News 6 New Docker Vulnerabilities - 3 Critical, 3 High Severity Jun 19, 2026 News Critical Label Injection RCE in Kubernetes containerd CRI Plugin - CVE-2026-53488 Jun 19, 2026

Executive ViewAI

Why It Matters

containerd runtime vulnerability (CVE-2026-53488) in versions before 1.7.33/2.0.10/2.1.9/2.2.5/2.3.2 permits container escape to host with root-level access via image labels. Any organization running containerized applications with untrusted or compromised image sources faces complete infrastructure compromise without immediate patching.

Business Impact: Severe
Compensating Controls

Vendor-released patch: containerd 1.7.33, 2.0.10, 2.1.9, 2.2.5, 2.3.2. Interim mitigations if patching is delayed: disable label-consuming plugins if not operationally required; restrict container image pulls to internal/curated registries; implement image vulnerability scanning and audit all running containers for suspicious labels.

Threat Intelligence Overview

EPSS Score
0.2%
Top 86% exploitable
Prevalence
Ubiquitous
core CNCF container runtime underpinning most Kubernetes and Docker deployments
Threat Intel
1
1 sources
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS GHSA Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Very High

Priority Score

47
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +47
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in containerd Multiple Security Flaws

View all 5
CVE-2026-47262 MEDIUM
5.3
CVE-2026-53492 HIGH
8.4
CVE-2026-53489 HIGH
8.2
CVE-2026-50195 MEDIUM
5.6

More in Containerd

View all
CVE-2023-25173 HIGH POC
7.8 Feb 16

containerd is an open source container runtime. Rated high severity (CVSS 7.8), this vulnerability is low attack complex
CVE-2022-23648 HIGH POC
7.5 Mar 03

containerd is a container runtime available as a daemon for Linux and Windows. Rated high severity (CVSS 7.5), this vuln
CVE-2026-53493 MEDIUM POC
6.9 Sep 25

Denial of service in containerd versions prior to 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 allows an unauthenticated atta
CVE-2026-47218 CRITICAL
9.3 Oct 15

Native code execution inside the shim zygote process is possible in runwasi's containerd-shim-wasmtime-v1 prior to 0.6.1
CVE-2026-95837 HIGH
7.8 Oct 12

Privilege escalation in containerd's CRI checkpoint-restore path allows an authenticated local attacker who can submit a
CVE-2021-41103 HIGH
7.8 Oct 04

containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. Rated high se
CVE-2026-107446 MEDIUM
6.8 Oct 08

Integer overflow in containerd overlaybd's LSMT index loader (do_load_index) lets a crafted, untrusted overlaybd blob pu
CVE-2022-23471 MEDIUM
6.5 Dec 07

containerd is an open source container runtime. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploit
CVE-2021-32760 MEDIUM
6.3 Jul 19

containerd is a container runtime. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no auth
CVE-2021-21334 MEDIUM
6.3 Mar 10

In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through con

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Package Hub 15 SP7 Fixed
openSUSE Tumbleweed Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:35111 ADVISORY https://access.redhat.com/errata/RHSA-2026:36105 ADVISORY https://access.redhat.com/errata/RHSA-2026:36167 ADVISORY https://access.redhat.com/errata/RHSA-2026:36207 ADVISORY https://access.redhat.com/errata/RHSA-2026:36319 ADVISORY https://access.redhat.com/errata/RHSA-2026:36625 ADVISORY https://access.redhat.com/errata/RHSA-2026:36873 ADVISORY https://access.redhat.com/errata/RHSA-2026:37252 ADVISORY https://access.redhat.com/errata/RHSA-2026:41030 ADVISORY https://access.redhat.com/errata/RHSA-2026:42852 ADVISORY https://access.redhat.com/errata/RHSA-2026:44622 ADVISORY https://seclists.org/oss-sec/2026/q2/970 ADVISORY https://ubuntu.com/security/notices/USN-8471-1 ADVISORY https://ubuntu.com/security/notices/USN-8472-1 ADVISORY https://ubuntu.com/security/notices/USN-8473-1 ADVISORY https://vuldb.com/vuln/372572 REF https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy