CVE-2026-53489

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.
Symlink
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Debian logo
Debian Releases
Debian Product
Codename
containerd
bookworm
1.6.20~ds1-1+deb12u3
fixed
bookworm (security)
1.6.20~ds1-1+deb12u2
fixed
bullseye
1.4.13~ds1-1~deb11u4
fixed
bullseye (security)
1.4.13~ds1-1~deb11u6
fixed
forky
2.1.9+ds1-1
fixed
sid
2.1.9+ds1-1
fixed
trixie
1.7.24~ds1-6+deb13u1
fixed
trixie (security)
1.7.24~ds1-6+deb13u1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
containerd
Amazon Linux 2023
0:2.2.4-1.amzn2023.0.3
fixed
containerd-debuginfo
Amazon Linux 2023
0:2.2.4-1.amzn2023.0.3
fixed
containerd-debugsource
Amazon Linux 2023
0:2.2.4-1.amzn2023.0.3
fixed
containerd-stress
Amazon Linux 2023
0:2.2.4-1.amzn2023.0.3
fixed
containerd-stress-debuginfo
Amazon Linux 2023
0:2.2.4-1.amzn2023.0.3
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
containerd2
Azure Linux 3.0
0:2.2.4-3.azl3
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388