Read the docs
TI-2021-19622 Aliases CVE-2021-43816GHSA-mvff-h3cj-wj9c

Improper Preservation of Permissions in containerd

Priority HIGH 74CWE-281Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any privileged, regular file on disk for complete read/write access (sans delete). Such is achieved by placing the in-container location of the hostPath volume mount at either `/etc/hosts`, `/etc/hostname`, or `/etc/resolv.conf`. These locations are being relabeled indiscriminately to match the container process-label which effectively elevates permissions for savvy containers that would not normally be able to access privileged host files. This issue has been resolved in version 1.5.9. Users are advised to upgrade as soon as possible.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01809 78th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial containerd (containerd): 1.5.9github.com/containerd/containerd (Go): 1.5.9Red Hat: 2 advisoriesRed Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstagecontainerd1.5.0 to before 1.5.91.5.9Patch availableCNA
—github.com/containerd/containerd (Go)1.5.0 to before 1.5.91.5.9Patch availableGHSA-mvff-h3cj-wj9c
  • containerd Vendorbackstage Affected 1.5.0 to before 1.5.9 Fixed in 1.5.9 Patch available CNA
  • github.com/containerd/containerd (Go) Vendor— Affected 1.5.0 to before 1.5.9 Fixed in 1.5.9 Patch available GHSA-mvff-h3cj-wj9c

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*1.5.1 to before 1.5.9Vulnerablebackstage
cpe:2.3:a:linuxfoundation:containerd:1.5.0:-:*:*:*:*:*:*1.5.0Vulnerablebackstage
cpe:2.3:a:linuxfoundation:containerd:1.5.0:beta0:*:*:*:*:*:*1.5.0 beta0Vulnerablebackstage
cpe:2.3:a:linuxfoundation:containerd:1.5.0:beta1:*:*:*:*:*:*1.5.0 beta1Vulnerablebackstage
cpe:2.3:a:linuxfoundation:containerd:1.5.0:beta2:*:*:*:*:*:*1.5.0 beta2Vulnerablebackstage
cpe:2.3:a:linuxfoundation:containerd:1.5.0:beta3:*:*:*:*:*:*1.5.0 beta3Vulnerablebackstage
cpe:2.3:a:linuxfoundation:containerd:1.5.0:beta4:*:*:*:*:*:*1.5.0 beta4Vulnerablebackstage
cpe:2.3:a:linuxfoundation:containerd:1.5.0:rc0:*:*:*:*:*:*1.5.0 rc0Vulnerablebackstage
cpe:2.3:a:linuxfoundation:containerd:1.5.0:rc1:*:*:*:*:*:*1.5.0 rc1Vulnerablebackstage
cpe:2.3:a:linuxfoundation:containerd:1.5.0:rc2:*:*:*:*:*:*1.5.0 rc2Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* Versions 1.5.1 to before 1.5.9 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:containerd:1.5.0:-:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:containerd:1.5.0:beta0:*:*:*:*:*:* Versions 1.5.0 beta0 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:containerd:1.5.0:beta1:*:*:*:*:*:* Versions 1.5.0 beta1 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:containerd:1.5.0:beta2:*:*:*:*:*:* Versions 1.5.0 beta2 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:containerd:1.5.0:beta3:*:*:*:*:*:* Versions 1.5.0 beta3 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:containerd:1.5.0:beta4:*:*:*:*:*:* Versions 1.5.0 beta4 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:containerd:1.5.0:rc0:*:*:*:*:*:* Versions 1.5.0 rc0 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:containerd:1.5.0:rc1:*:*:*:*:*:* Versions 1.5.0 rc1 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:containerd:1.5.0:rc2:*:*:*:*:*:* Versions 1.5.0 rc2 Vulnerable ·backstage
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:containerd:1.5.0:rc3:*:*:*:*:*:*1.5.0 rc3Vulnerablebackstage
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
  • cpe:2.3:a:linuxfoundation:containerd:1.5.0:rc3:*:*:*:*:*:* Versions 1.5.0 rc3 Vulnerable ·backstage
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA containerd (containerd) Fixed in 1.5.9
  • Fix · GHSA-mvff-h3cj-wj9c github.com/containerd/containerd (Go) Fixed in 1.5.9 Advisory →

Red Hat 2 advisories

  • RHSA-2022:4956 Released 2022-06-09 · Red Hat rating Important
    Red Hat Advanced Cluster Management 2.5 security updates, images, and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8 rhacm2/acm-cluster-proxy-rhel8, rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8 +47
  • RHSA-2022:0735 Released 2022-03-03 · Red Hat rating Important
    Red Hat Advanced Cluster Management 2.4.2 security updates and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenStack Platform 16.2AffectedNo fix planned: Will not fix
Not affected: 3 products
  • OpenShift Developer Tools and Services
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-43816
  2. 2026-10-03 Alias added: GHSA-mvff-h3cj-wj9c

References

Exploit 1

Patch 2

Advisory 4

Other 3

  • TI-2023-10635 containerd supplementary groups are not set up properly CVSS 3.1HIGH 7.8
  • TI-2022-07700 Insecure handling of image volumes in containerd CRI plugin CVSS 3.1HIGH 7.5
  • TI-2026-38567 Improper input validation in backstage containerd CVSS 4.0CRITICAL 9.4
  • TI-2026-38569 containerd CRI checkpoint restore CDI annotation smuggling CVSS 4.0HIGH 8.4
  • TI-2025-29820 Containerd vulnerable to host filesystem access during image unpack CVSS 4.0HIGH 7.6
  • TI-2026-38568 containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore CVSS 4.0HIGH 8.2
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences