CVE-2026-53492Disclosure(linuxfoundation / containerd)

LOWCVSS 9.6 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch linuxfoundation containerd systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations from the checkpoint archive rather than relying solely on the pod's create-time specification. This allows a user with pod creation permissions to bypass standard Kubernetes resource allocation and device plugin enforcement, injecting arbitrary CDI edits (such as device nodes and host mounts) into the restored container. Successful exploitation requires that the node has CDI enabled and contains a matching host CDI specification for the requested device; environments where CDI is disabled or lacking sensitive device specifications are not affected. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.

linuxfoundation CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc

Weakness type (CWE)

CWE-20CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

containerd

Threat summary

Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 2d ago at 1 mentions (2026-06-19); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

linuxfoundation

Products

containerd

Deep dive

Activity timeline3 mentions / 3d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets2 URLs

By indicator

Full discourse3 posts

Upwind Security MDR@UpwindMDR80d
Disclosure
🚨Critical - containerd CRI Plugin Multiple Vulnerabilities (CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262) AWS disclosed five flaws in the containerd CRI plugin (v1.7–2.3), the runtime behind EKS, ECS, Fargate, GKE and self-managed Kubernetes. Most are reachable by an attacker who only has permission to create pods on a shared node. The headline bug lets a crafted checkpoint image poison the node's local image cache so other pods unknowingly run the attacker's image — cross-pod code execution. Even nastier: unsanitized image LABEL instructions reach the restart-monitor binary:// logger, giving host-root command execution straight from an image pull, with no checkpoint/restore required. The rest cover CDI annotation smuggling (device/host-mount injection), arbitrary host file read via symlinked log paths, and an image-triggered OOM DoS. 👉Upgrade to containerd 2.3.2 / 2.2.5 / 2.1.9.
Post summary
AWS disclosed five critical vulnerabilities in containerd CRI plugin, detailing how attackers can achieve cross‑pod and host‑root execution, along with a patch recommendation.
00100112
232 followersView on X
takenaka hiroya@Joe_Biden_ja54d
Disclosure
脆弱性対応ウォッチに、containerdの新しい脆弱性「CVE-2026-53492」を追加しました。CVSS 9.6 Criticalと評価されており、チェックポイント復元時の権限昇格につながる可能性があります。関連するシステムをご利用の方は、早めの情報確認と対応をおすすめ… https://cve.autoarticles.net/cve/CVE-2026-53492
Post summary
The post announces the new containerd vulnerability CVE‑2026‑53492, rated critical with possible privilege escalation on checkpoint restore, and encourages users to check and apply updates, but does not mention exploits, patches, or active attacks.
0000047
561 followersView on X
DailyCVE@dailycve91d
Disclosure
🔴 containerd, Improper Input Validation, #CVE-2026-53492 (High) -DC-Jun2026-503 https://dailycve.com/containerd-improper-input-validation-cve-2026-53492-high-dc-jun2026-503/
Post summary
A new vulnerability (CVE‑2026‑53492) affecting containerd has been disclosed, identified as Improper Input Validation with a high severity rating; no exploit, PoC, or patch information is provided.
0000028
213 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	linuxfoundation	containerd	-	-	-

Explore more

Back to dashboard linuxfoundation CVEs containerd vulnerabilities