CVE catalog

CVE-2026-53489

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinke

[CVE catalog]

Severity
High · CVSS 8.2
Published
Source
[NVD] · [CVE record]
EPSS
0.17% · Oct 25, 2026

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancontainerdsid2.1.9+ds1-5fixed
Debiancontainerdforky2.1.9+ds1-5fixed
Debiancontainerdtrixie1.7.24~ds1-6+deb13u1not affected
Debiancontainerdtrixie-security1.7.24~ds1-6+deb13u1not affected
Debiancontainerdbookworm1.6.20~ds1-1+deb12u3not affected
Debiancontainerdbookworm-security1.6.20~ds1-1+deb12u2not affected
Cpecontainerd-appNot reported2.2.1-0ubuntu1~24.04.3fixed
CpecontainerdNot reported2.2.1-0ubuntu1~24.04.3fixed
CpecontainerdNot reported2.1.9fixed
CpecontainerdNot reported2.2.5fixed
CpecontainerdNot reported2.3.2fixed
Ubuntucontainerd-app22.041.7.2-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-app22.041.7.12-0ubuntu2~22.04.1vulnerable
Ubuntucontainerd-app22.041.7.24-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-app22.041.7.24-0ubuntu1~22.04.2vulnerable
Ubuntucontainerd-app22.041.7.27-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-app22.041.7.28-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-app22.042.2.1-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-app22.042.2.1-0ubuntu1~22.04.2fixed
Ubuntucontainerd-app24.041.7.2-0ubuntu2vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu1vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu2vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu3vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu4vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu4.1vulnerable
Ubuntucontainerd-app24.041.7.19-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.19+really1.7.12-0ubuntu4.2vulnerable
Ubuntucontainerd-app24.041.7.24-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.24-0ubuntu1~24.04.2vulnerable
Ubuntucontainerd-app24.041.7.27-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.28-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.28-0ubuntu1~24.04.2vulnerable
Ubuntucontainerd-app24.042.2.1-0ubuntu1~24.04.2vulnerable
Ubuntucontainerd-app24.042.2.1-0ubuntu1~24.04.3fixed
Ubuntucontainerd-app25.102.0.2-0ubuntu2vulnerable
Ubuntucontainerd-app25.102.0.5-0ubuntu1vulnerable
Ubuntucontainerd-app25.102.1.3-0ubuntu2vulnerable
Ubuntucontainerd-app25.102.1.3-0ubuntu3vulnerable
Ubuntucontainerd-app25.102.1.3-0ubuntu3.1vulnerable
Ubuntucontainerd-app25.102.2.1-0ubuntu1~25.10.1vulnerable
Ubuntucontainerd-app25.102.2.1-0ubuntu1~25.10.2fixed
Ubuntucontainerd-stable25.102.1.3-0ubuntu1vulnerable
Ubuntucontainerd-stable25.102.1.6-0ubuntu1~25.10.1vulnerable
Ubuntucontainerd-stable25.102.1.6-0ubuntu1~25.10.2fixed
Ubuntucontainerd-app26.042.1.3-0ubuntu3vulnerable
Ubuntucontainerd-app26.042.2.1-0ubuntu1vulnerable
Ubuntucontainerd-app26.042.2.2-0ubuntu1vulnerable
Ubuntucontainerd-app26.042.2.2-0ubuntu1.1fixed
Ubuntucontainerd-stable26.042.1.3-0ubuntu1vulnerable
Ubuntucontainerd-stable26.042.1.5-0ubuntu1vulnerable
Ubuntucontainerd-stable26.042.2.1-0ubuntu1vulnerable
Ubuntucontainerd-stable26.042.2.2-0ubuntu1vulnerable
Ubuntucontainerd-stable26.042.2.2-0ubuntu1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancontainerdsourcesid2.1.9+ds1-1not yet assignedNot reported[1140385]
Debiancontainerdsourceforky2.1.9+ds1-1not yet assignedNot reported[1140385]
DebiancontainerdsourcetrixieNot affectedunimportantNot reported[1140385]
DebiancontainerdsourcebookwormNot affectedunimportantNot reported[1140385]
Cpecontainerd-appcpeNot reported2.2.1-0ubuntu1~24.04.3Not reportedNot reportedNot reported
CpecontainerdcpeNot reported2.2.1-0ubuntu1~24.04.3Not reportedNot reportedNot reported
CpecontainerdcpeNot reported2.1.9Not reportedNot reportedNot reported
CpecontainerdcpeNot reported2.2.5Not reportedNot reportedNot reported
CpecontainerdcpeNot reported2.3.2Not reportedNot reportedNot reported
Ubuntucontainerd-appdeb22.042.2.1-0ubuntu1~22.04.2Not reportedUBUNTU-CVE-2026-53489Not reported
Ubuntucontainerd-appdeb24.042.2.1-0ubuntu1~24.04.3Not reportedUBUNTU-CVE-2026-53489Not reported
Ubuntucontainerd-appdeb25.102.2.1-0ubuntu1~25.10.2Not reportedUBUNTU-CVE-2026-53489Not reported
Ubuntucontainerd-stabledeb25.102.1.6-0ubuntu1~25.10.2Not reportedUBUNTU-CVE-2026-53489Not reported
Ubuntucontainerd-appdeb26.042.2.2-0ubuntu1.1Not reportedUBUNTU-CVE-2026-53489Not reported
Ubuntucontainerd-stabledeb26.042.2.2-0ubuntu1.1Not reportedUBUNTU-CVE-2026-53489Not reported

[Debian bug #1140385]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [containerd]Not affected
    Details (4)

    • 1.6.20~ds1-1+deb12u3 · amd64 · bookworm

      Not affected

      nvd · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u3 · arm64 · bookworm

      Not affected

      nvd · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u2 · amd64 · bookworm-security

      Not affected

      nvd · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u2 · arm64 · bookworm-security

      Not affected

      nvd · containerd · debian · bookworm

  • [golang-github-containerd-containerd-dev]Not affected

    Source package: [containerd]

    Details (4)

    • 1.6.20~ds1-1+deb12u3 · all · bookworm

      Not affected

      nvd · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u3 · all · bookworm

      Not affected

      nvd · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u2 · all · bookworm-security

      Not affected

      nvd · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u2 · all · bookworm-security

      Not affected

      nvd · containerd · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]