Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-19 | 1 | Disclosure1 |
| 2026-07-01 | 2 | Disclosure2 |
| 2026-07-03 | 1 | Disclosure1 |
Warning: Critical Improper Input Validation Vulnerability in #containerd. CVE-2026-53488 CVSS: 9.4. This can lead to arbitrary command execution on the host. #Patch #Patch #Patch
Post summary
A critical improper input validation issue (CVE-2026-53488) affecting containerd has been disclosed, with a CVSS score of 9.4 and the ability to achieve arbitrary command execution on the host.
Your Dockerfile LABEL instructions can execute arbitrary commands on the host. CVE-2026-53488 in containerd. Here's what to check Friday:
Post summary
The post discloses CVE-2026-53488, noting that Dockerfile LABEL instructions allow arbitrary command execution on the host through containerd, without mentioning PoCs, exploits, or patches.
🚨Critical - containerd CRI Plugin Multiple Vulnerabilities (CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262) AWS disclosed five flaws in the containerd CRI plugin (v1.7–2.3), the runtime behind EKS, ECS, Fargate, GKE and self-managed Kubernetes. Most are reachable by an attacker who only has permission to create pods on a shared node. The headline bug lets a crafted checkpoint image poison the node's local image cache so other pods unknowingly run the attacker's image — cross-pod code execution. Even nastier: unsanitized image LABEL instructions reach the restart-monitor binary:// logger, giving host-root command execution straight from an image pull, with no checkpoint/restore required. The rest cover CDI annotation smuggling (device/host-mount injection), arbitrary host file read via symlinked log paths, and an image-triggered OOM DoS. 👉Upgrade to containerd 2.3.2 / 2.2.5 / 2.1.9.
Post summary
AWS announced five critical vulnerabilities in the containerd CRI plugin that can lead to cross‑pod code execution and host‑root command execution, affecting several Kubernetes platforms. Patches are available by upgrading to specified containerd versions.
🔴 containerd CRI, Image-Config Label Injection, #CVE-2026-53488 (High Severity) -DC-Jun2026-492 https://dailycve.com/containerd-cri-image-config-label-injection-cve-2026-53488-high-severity-dc-jun2026-492/
Post summary
The text announces a high‑severity CVE (CVE‑2026‑53488) for containerd CRI involving Image‑Config Label Injection, but offers no details on exploitation, mitigation, or active attacks.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | linuxfoundation | containerd | - | - | - |