environment variable leak
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-668 and the CVSS impact.
Summary
In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | containerd | before 1.3.10; 1.4.0 to before 1.4.4 | 1.3.10, 1.4.4 | Patch available | CNA |
| — | github.com/containerd/containerd (Go) | 1.4.0 to before 1.4.4 | 1.4.4 | Patch available | GHSA-6g2q-w5j3-fwh4 |
| — | github.com/containerd/containerd (Go) | before 1.3.10 | 1.3.10 | Patch available | GHSA-6g2q-w5j3-fwh4 |
- containerd Vendorbackstage Affected before 1.3.10; 1.4.0 to before 1.4.4 Fixed in 1.3.10, 1.4.4 Patch available CNA
- github.com/containerd/containerd (Go) Vendor— Affected 1.4.0 to before 1.4.4 Fixed in 1.4.4 Patch available GHSA-6g2q-w5j3-fwh4
- github.com/containerd/containerd (Go) Vendor— Affected before 1.3.10 Fixed in 1.3.10 Patch available GHSA-6g2q-w5j3-fwh4
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* | before 1.3.10; 1.4.0 to before 1.4.4 | Vulnerable | backstage |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
- cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* Versions before 1.3.10; 1.4.0 to before 1.4.4 Vulnerable ·backstage
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA containerd (containerd) Fixed in 1.3.10, 1.4.4
- Fix · GHSA-6g2q-w5j3-fwh4 github.com/containerd/containerd (Go) Fixed in 1.4.4 Advisory →
- Fix · GHSA-6g2q-w5j3-fwh4 github.com/containerd/containerd (Go) Fixed in 1.3.10 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 5 products
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Virtualization 2
- Red Hat Openshift Container Storage 4
- Red Hat Quay 3
Timeline
- 2026-10-02 Threatist record created from CVE-2021-21334
- 2026-10-03 Alias added: GHSA-6g2q-w5j3-fwh4
References
Advisory 8
- https://github.com/containerd/containerd/security/advisories/GHSA-6g2q-w5j3-fwh4
- https://github.com/containerd/containerd/releases/tag/v1.4.4
- https://github.com/containerd/containerd/releases/tag/v1.3.10
- FEDORA-2021-470fa24f5b
- FEDORA-2021-10ce8fcbf1
- FEDORA-2021-f049305892
- GLSA-202105-33
- https://nvd.nist.gov/vuln/detail/CVE-2021-21334
Other 7
- https://github.com/containerd/cri/pull/1628
- https://github.com/containerd/cri/pull/1629
- https://github.com/containerd/containerd/commit/2d9c8aa4b3f4313982c5c999af57212a1c5d144b
- https://github.com/containerd/containerd/commit/cbcb2f57fbe221986f96b552855eb802f63193de
- https://lists.fedoraproject.org/archives/list/[email protected]/message/KUE2Z2ZUWBHRU36ZGBD2YSJCYB6ELPXE
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QIBPKSX5IOWPM3ZPFB3JVLXWDHSZTTWT
- https://lists.fedoraproject.org/archives/list/[email protected]/message/VTXHA5JOWQRCCUZH7ZQBEYN6KZKJEYSD
More backstage Containerd vulnerabilities
- TI-2021-19622 Improper Preservation of Permissions in containerd CVSS 3.1CRITICAL 9.1
- TI-2023-10635 containerd supplementary groups are not set up properly CVSS 3.1HIGH 7.8
- TI-2022-07700 Insecure handling of image volumes in containerd CRI plugin CVSS 3.1HIGH 7.5
- TI-2026-38567 Improper input validation in backstage containerd CVSS 4.0CRITICAL 9.4
- TI-2026-38569 containerd CRI checkpoint restore CDI annotation smuggling CVSS 4.0HIGH 8.4
- TI-2025-29820 Containerd vulnerable to host filesystem access during image unpack CVSS 4.0HIGH 7.6
Sources
- CVE-2021-21334 · CVE Program
- CVE-2021-21334 · NVD
- FIRST EPSS
- GHSA-6g2q-w5j3-fwh4 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-21334 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences