CVE-2026-53489
EUVD-2026-4111001.07.2026, 19:16
containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| linuxfoundation | containerd | 2.1.0 ≤ 𝑥 < 2.1.9 |
| linuxfoundation | containerd | 2.2.0 ≤ 𝑥 < 2.2.5 |
| linuxfoundation | containerd | 2.3.0 ≤ 𝑥 < 2.3.2 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| containerd |
| ||||||||||||
| containerd-app |
| ||||||||||||
| containerd-stable |
|
Amazon Linux Releases
Amazon Package | |||
|---|---|---|---|
| containerd |
| ||
| containerd-debuginfo |
| ||
| containerd-debugsource |
| ||
| containerd-stress |
| ||
| containerd-stress-debuginfo |
|
Vulnerability Media Exposure