Skip to main content

containerd CVE-2026-53489

| EUVDEUVD-2026-41110 HIGH
UNIX Symbolic Link (Symlink) Following (CWE-61)
2026-06-19 GHSA-rgh6-rfwx-v388
Information Disclosure Containerd Checkpoint
8.2
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
8.2 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Local vector requiring the ability to introduce a checkpoint (PR:L); crossing the container-to-host boundary is a scope change (S:C) yielding high confidentiality only (C:H), with no integrity or availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

6
Source Code Evidence Fetched
Jul 01, 2026 - 19:28 vuln.today
Analysis Updated
Jul 01, 2026 - 19:28 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 01, 2026 - 19:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 01, 2026 - 19:22 vuln.today
cvss_changed
CVSS changed
Jul 01, 2026 - 19:22 NVD
8.2 (HIGH)
Analysis Generated
Jun 19, 2026 - 02:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Arbitrary host file disclosure in containerd's CRI plugin lets an attacker read any file on the Kubernetes node via kubectl logs because the plugin restores container.log from a checkpoint image while blindly following a symlinked path. All containerd 2.x branches before 2.1.9, 2.2.5, and 2.3.2 are affected wherever container checkpoint/restore (CRIU-based) is used. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft checkpoint image with symlinked container.log
Delivery
Get malicious checkpoint restored on node
Exploit
CRI plugin follows symlink to host file
Execution
Operator runs kubectl logs
Impact
Arbitrary host file contents disclosed
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the containerd CRI plugin performs a checkpoint restore of an attacker-controlled or attacker-influenced checkpoint image containing a `container.log` entry that is a symlink to a host file; the payload is then read when someone invokes `kubectl logs` against the restored container. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score is 8.2 (High) with vector AV:L/AC:L/AT:N/PR:N/UI:N and VC:H plus SC:H, signalling high confidentiality impact on both the vulnerable and a subsequent system (the host) with local access and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker able to supply or influence a container checkpoint image embeds a `container.log` entry that is actually a symlink to a sensitive host file such as `/etc/shadow` or a service-account token. After the malicious checkpoint is restored on a node, the attacker (or an unwitting operator) runs `kubectl logs` against the resulting pod, and containerd dereferences the symlink and returns the host file's contents. …
Remediation Vendor-released patch: upgrade to containerd 2.1.9, 2.2.5, or 2.3.2 depending on your branch (2.1.x → 2.1.9, 2.2.x → 2.2.5, 2.3.x → 2.3.2), as documented in advisory GHSA-rgh6-rfwx-v388 (https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388); Ubuntu users should apply the packages from USN-8472-1 and USN-8473-1 (https://ubuntu.com/security/notices/USN-8472-1, https://ubuntu.com/security/notices/USN-8473-1). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

24 hours: Identify all Kubernetes clusters using containerd 2.x versions prior to 2.1.9, 2.2.5, or 2.3.2. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Containerd

View all
CVE-2026-53488 CRITICAL
9.4 Jun 19

Host command execution in containerd's CRI plugin arises because labels from an image config (Dockerfile LABEL instructi
CVE-2026-53492 HIGH
8.4 Jun 19

Kubernetes device-plugin and resource-allocation enforcement can be bypassed in containerd by a namespace user holding p
CVE-2026-50195 MEDIUM
5.6 Jun 19

Checkpoint image poisoning in containerd's CRI implementation allows an attacker with pod-creation permissions to corrup
CVE-2026-47262 MEDIUM
5.3 Jun 19

Memory exhaustion via maliciously crafted container image in containerd causes an OOM kill of the containerd process, re
CVE-2024-40635 MEDIUM
4.6 Mar 17

containerd is an open-source container runtime. Rated medium severity (CVSS 4.6), this vulnerability is low attack compl
CVE-2025-64329 MEDIUM
6.9 Nov 07

containerd is an open-source container runtime. Rated medium severity (CVSS 6.9), this vulnerability is no authenticatio
CVE-2024-25621 HIGH
7.3 Nov 06

containerd is an open-source container runtime. Rated high severity (CVSS 7.3), this vulnerability is low attack complex
CVE-2025-47291 MEDIUM
4.6 May 21

containerd is an open-source container runtime. Rated medium severity (CVSS 4.6), this vulnerability is no authenticatio
CVE-2025-47290 HIGH
7.6 May 20

containerd is a container runtime. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, no authen

Same weakness CWE-61 – UNIX Symbolic Link (Symlink) Following

View all
CVE-2026-54420 HIGH POC
8.5
CVE-2026-27976 HIGH POC
8.8
CVE-2025-52565 HIGH POC
8.4
CVE-2026-41326 HIGH POC
8.2
CVE-2025-1079 HIGH POC
7.8
CVE-2025-52881 HIGH POC
7.3
CVE-2025-31133 HIGH POC
7.3
CVE-2026-23986 HIGH POC
7.1

Same technique Information Disclosure

View all
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2014-6324 HIGH POC
8.8
CVE-2017-0213 HIGH POC
7.3
CVE-2016-7255 HIGH POC
7.8
CVE-2010-0232 HIGH POC
7.8
CVE-2025-30066 HIGH POC
8.6
CVE-2025-54236 CRITICAL POC
9.1

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Package Hub 15 SP7 Fixed
openSUSE Tumbleweed Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected

Share

CVE-2026-53489 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy