🚨Critical - containerd CRI Plugin Multiple Vulnerabilities (CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262) AWS disclosed five flaws in the containerd CRI plugin (v1.7–2.3), the runtime behind EKS, ECS, Fargate, GKE and self-managed Kubernetes. Most are reachable by an attacker who only has permission to create pods on a shared node. The headline bug lets a crafted checkpoint image poison the node's local image cache so other pods unknowingly run the attacker's image — cross-pod code execution. Even nastier: unsanitized image LABEL instructions reach the restart-monitor binary:// logger, giving host-root command execution straight from an image pull, with no checkpoint/restore required. The rest cover CDI annotation smuggling (device/host-mount injection), arbitrary host file read via symlinked log paths, and an image-triggered OOM DoS. 👉Upgrade to containerd 2.3.2 / 2.2.5 / 2.1.9.
Post summary
AWS disclosed five containerd CRI plugin vulnerabilities that enable cross‑pod code execution, host‑level exploits, and DoS attacks. The post provides technical details and recommends upgrading to patched containerd versions.