What’s Vulnerable › Vulnerabilities
CVE-2026-53488: containerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-01 · updated 2026-07-03
- Weakness: CWE-20
Description
containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.
Affected products
- containerd: from 1.7.0 before 1.7.33; from 2.0.0 before 2.0.10; from 2.1.0 before 2.1.9; from 2.2.0 before 2.2.5; from 2.3.0 before 2.3.2 — fixed in 1.7.33, 2.0.10, 2.1.9, 2.2.5, 2.3.2
How to fix
Upgrade to a fixed version: containerd 1.7.33, 2.0.10, 2.1.9, 2.2.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-53488 or the next vulnerability affects your stack