Read the docs
TI-2026-38567 Aliases CVE-2026-53488GHSA-xhf5-7wjv-pqxp

Improper input validation in backstage containerd

Priority MEDIUM 42CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 29 fixed, 23 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00176 7th percentileScored 2026-11-07
Fix Partial containerd (containerd): 1.7.33, 2.0.10, 2.1.9 +2github.com/containerd/containerd (Go): 1.7.33+1 more productRed Hat: 34 advisoriesRed Hat: 29 fixed, 23 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstagecontainerdbefore 1.7.33; 2.0.0 to before 2.0.10; 2.1.0 to before 2.1.9; 2.2.0 to before 2.2.5; 2.3.0 to before 2.3.21.7.33, 2.0.10, 2.1.9, 2.2.5, 2.3.2Patch availableCNA
—github.com/containerd/containerd (Go)1.7.0 to before 1.7.331.7.33Patch availableGHSA-xhf5-7wjv-pqxp
—github.com/containerd/containerd/v2 (Go)2.0.0 to before 2.0.102.0.10Patch availableGHSA-xhf5-7wjv-pqxp
—github.com/containerd/containerd/v2 (Go)2.1.0 to before 2.1.92.1.9Patch availableGHSA-xhf5-7wjv-pqxp
—github.com/containerd/containerd/v2 (Go)2.2.0 to before 2.2.52.2.5Patch availableGHSA-xhf5-7wjv-pqxp
—github.com/containerd/containerd/v2 (Go)2.3.0 to before 2.3.22.3.2Patch availableGHSA-xhf5-7wjv-pqxp
  • containerd Vendorbackstage Affected before 1.7.33; 2.0.0 to before 2.0.10; 2.1.0 to before 2.1.9; 2.2.0 to before 2.2.5; 2.3.0 to before 2.3.2 Fixed in 1.7.33, 2.0.10, 2.1.9, 2.2.5, 2.3.2 Patch available CNA
  • github.com/containerd/containerd (Go) Vendor— Affected 1.7.0 to before 1.7.33 Fixed in 1.7.33 Patch available GHSA-xhf5-7wjv-pqxp
  • github.com/containerd/containerd/v2 (Go) Vendor— Affected 2.0.0 to before 2.0.10 Fixed in 2.0.10 Patch available GHSA-xhf5-7wjv-pqxp
  • github.com/containerd/containerd/v2 (Go) Vendor— Affected 2.1.0 to before 2.1.9 Fixed in 2.1.9 Patch available GHSA-xhf5-7wjv-pqxp
  • github.com/containerd/containerd/v2 (Go) Vendor— Affected 2.2.0 to before 2.2.5 Fixed in 2.2.5 Patch available GHSA-xhf5-7wjv-pqxp
  • github.com/containerd/containerd/v2 (Go) Vendor— Affected 2.3.0 to before 2.3.2 Fixed in 2.3.2 Patch available GHSA-xhf5-7wjv-pqxp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*1.7.0 to before 1.7.33; 2.0.0 to before 2.0.10; 2.1.0 to before 2.1.9; 2.2.0 to before 2.2.5; 2.3.0 to before 2.3.2Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* Versions 1.7.0 to before 1.7.33; 2.0.0 to before 2.0.10; 2.1.0 to before 2.1.9; 2.2.0 to before 2.2.5; 2.3.0 to before 2.3.2 Vulnerable ·backstage

Remediation

  • Fix · CNA containerd (containerd) Fixed in 1.7.33, 2.0.10, 2.1.9, 2.2.5, 2.3.2
  • Fix · GHSA-xhf5-7wjv-pqxp github.com/containerd/containerd (Go) Fixed in 1.7.33 Advisory →
  • Fix · GHSA-xhf5-7wjv-pqxp github.com/containerd/containerd/v2 (Go) Fixed in 2.0.10 Advisory →
  • Fix · GHSA-xhf5-7wjv-pqxp github.com/containerd/containerd/v2 (Go) Fixed in 2.1.9 Advisory →
  • Fix · GHSA-xhf5-7wjv-pqxp github.com/containerd/containerd/v2 (Go) Fixed in 2.2.5 Advisory →
  • Fix · GHSA-xhf5-7wjv-pqxp github.com/containerd/containerd/v2 (Go) Fixed in 2.3.2 Advisory →

Red Hat 34 advisories

  • RHSA-2026:94562 Released 2026-11-03 · Red Hat rating Critical
    Red Hat OpenShift for Windows Containers 11.0 product release
    • Red Hat OpenShift for Windows Containers 11.0 registry.redhat.io/openshift4-wincw/windows-machine-config-rhel9-operator
  • RHSA-2026:71179 Released 2026-09-23 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9 +10
  • RHSA-2026:71177 Released 2026-09-23 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/aap-must-gather-rhel9, registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9 +4
Show 31 more Red Hat advisories
  • RHSA-2026:66377 Released 2026-09-15 · Red Hat rating Important
    OpenShift Container Platform 4.20.38 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:66352 Released 2026-09-15 · Red Hat rating Important
    OpenShift Container Platform 4.21.33 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:66022 Released 2026-09-09 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.5 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +4
  • RHSA-2026:63096 Released 2026-09-08 · Red Hat rating Important
    OpenShift Container Platform 4.22.13 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/aws-node-termination-handler-rhel9 +47
  • RHSA-2026:62260 Released 2026-09-01 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.0 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
  • RHSA-2026:60388 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +26
  • RHSA-2026:60387 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +24
  • RHSA-2026:60386 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.17.1 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +31
  • RHSA-2026:59467 Released 2026-08-25 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.4 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +3
  • RHSA-2026:57191 Released 2026-08-19 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9 +15
  • RHSA-2026:57013 Released 2026-08-19 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20.17 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2026:56366 Released 2026-08-18 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.22 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:53530 Released 2026-08-11 · Red Hat rating Critical
    Multicluster Global Hub 1.7.2 security update
    • Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:51084 Released 2026-08-06 · Red Hat rating Important
    RHTAS 1.0.2 - GA Release Of the Policy Controller Operator
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/policy-controller-rhel9-operator
  • RHSA-2026:51033 Released 2026-08-06 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.3 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +7
  • RHSA-2026:48872 Released 2026-07-30 · Red Hat rating Important
    RHACS 4.9.10 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-rhel8
  • RHSA-2026:47737 Released 2026-07-29 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.10 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +6
  • RHSA-2026:47451 Released 2026-07-28 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +9
  • RHSA-2026:47149 Released 2026-07-28 · Red Hat rating Important
    Multicluster Global Hub 1.7.2 security update
    • Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:46903 Released 2026-07-27 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +9
  • RHSA-2026:44622 Released 2026-07-23 · Red Hat rating Important
    Multicluster Global Hub 1.6.4 security update
    • Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:42852 Released 2026-07-21 · Red Hat rating Important
    Multicluster Global Hub 1.5.6 security update
    • Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:41030 Released 2026-07-16 · Red Hat rating Important
    Multicluster Global Hub 1.4.7 security update
    • Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:37252 Released 2026-07-09 · Red Hat rating Important
    Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.10.4
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9, registry.redhat.io/multicluster-engine/assisted-service-9-rhel9
  • RHSA-2026:36873 Released 2026-07-08 · Red Hat rating Important
    Submariner v0.20 security fixes and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/lighthouse-agent-rhel9, registry.redhat.io/rhacm2/lighthouse-coredns-rhel9, registry.redhat.io/rhacm2/nettest-rhel9 +5
  • RHSA-2026:36625 Released 2026-07-08 · Red Hat rating Important
    RHACS 4.10.5 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +3
  • RHSA-2026:36319 Released 2026-07-07 · Red Hat rating Important
    RHACS 4.9.9 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +3
  • RHSA-2026:36207 Released 2026-07-07 · Red Hat rating Important
    RHACS 4.11.1 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes 4.11 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9, registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle, registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator +4
  • RHSA-2026:36167 Released 2026-07-07 · Red Hat rating Important
    Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.6.12
    • multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/assisted-service-9-rhel9
  • RHSA-2026:36105 Released 2026-07-07 · Red Hat rating Important
    Assisted Installer RHEL 8 components for Multicluster Engine for Kubernetes 2.6.12
    • multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel8, registry.redhat.io/multicluster-engine/assisted-installer-rhel8, registry.redhat.io/multicluster-engine/assisted-service-8-rhel8
  • RHSA-2026:35111 Released 2026-07-02 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images trivy-0.72.0-0.1.hum1@aarch64, trivy-0.72.0-0.1.hum1@src, trivy-0.72.0-0.1.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Assisted Installer for Red Hat OpenShift Container Platform 2AffectedNo fix yet
Confidential Compute AttestationAffectedNo fix planned: Will not fix
Deployment Validation OperatorAffectedNo fix yet
Kernel Module Management Operator for Red Hat OpenshiftAffectedNo fix yet
MCP Server for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Machine Deletion Remediation OperatorAffectedNo fix yet
Migration Toolkit for VirtualizationAffectedNo fix planned: Will not fix
Multicluster Engine for KubernetesAffectedNo fix yet
Node HealthCheck OperatorAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix planned: Out of support scope
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
Power monitoring for Red Hat OpenShiftAffectedNo fix yet
Red Hat Advanced Cluster Security 4AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 6AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix planned: Will not fix
Multicluster Global Hub 1.4.9Fixed RHSA-2026:41030
Multicluster Global Hub 1.5.8Fixed RHSA-2026:42852
Multicluster Global Hub 1.6.6Fixed RHSA-2026:44622
Multicluster Global Hub 1.7.4Fixed RHSA-2026:47149, RHSA-2026:53530
OpenShift API for Data Protection 1.3Fixed RHSA-2026:51033
OpenShift API for Data Protection 1.4Fixed RHSA-2026:59467
OpenShift API for Data Protection 1.5Fixed RHSA-2026:66022
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:60387
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:36873, RHSA-2026:47737
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:60388
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:46903
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:57191
Red Hat Advanced Cluster Management for Kubernetes 2.17Fixed RHSA-2026:60386
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:36319, RHSA-2026:48872
Red Hat Advanced Cluster Security for Kubernetes 4.11Fixed RHSA-2026:36207
Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10Fixed RHSA-2026:36625
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:71179
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:71177
Red Hat Hardened ImagesFixed RHSA-2026:35111
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:66377
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:66352
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:63096
Red Hat OpenShift Dev Spaces 3.30Fixed RHSA-2026:62260
Red Hat OpenShift for Windows Containers 11.0Fixed RHSA-2026:94562
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:56366
Red Hat Openshift Data Foundation 4.20Fixed RHSA-2026:57013
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:51084
multicluster engine for Kubernetes 2.10Fixed RHSA-2026:37252
multicluster engine for Kubernetes 2.6Fixed RHSA-2026:36105, RHSA-2026:36167
Not affected: 48 products
  • Gatekeeper 3
  • Logging Subsystem for Red Hat OpenShift
  • Logical Volume Manager Storage
  • Migration Toolkit for Containers
  • Multicluster Engine for Kubernetes
  • Multicluster Global Hub 1.4.9
  • Multicluster Global Hub 1.5.8
  • Multicluster Global Hub 1.6.6
  • Multicluster Global Hub 1.7.4
  • OpenShift API for Data Protection 1.3
  • OpenShift API for Data Protection 1.4
  • OpenShift API for Data Protection 1.5
  • OpenShift Developer Tools and Services
  • OpenShift Lightspeed
  • OpenShift Service Mesh 2
  • OpenShift Service Mesh 3
  • Pen Drive Powered by Red Hat Lightspeed
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Management for Kubernetes 2.17
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Advanced Cluster Security for Kubernetes 4.11
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Build of Kueue
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Container Platform 4.22
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces 3.30
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenShift for Windows Containers 11.0
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Openshift Data Foundation 4.20
  • Red Hat Trusted Artifact Signer 1.4
  • Red Hat Trusted Profile Analyzer
  • multicluster engine for Kubernetes 2.10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53488
  2. 2026-10-03 Alias added: GHSA-xhf5-7wjv-pqxp
  3. 2026-10-23 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 · Red Hat
  4. 2026-10-30 Affected versions changed · Red Hat
  5. 2026-11-01 Fix available: Red Hat Advanced Cluster Security for Kubernetes 4.11 · Red Hat
  6. 2026-11-04 Fix available: RHSA-2026:94562 · Red Hat
  7. 2026-11-04 Fix available: Red Hat OpenShift for Windows Containers 11.0 · Red Hat
  8. 2026-11-05 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat
  9. 2026-11-06 Fix available: RHSA-2026:71177 · Red Hat
  10. 2026-11-06 Fix available: Multicluster Global Hub 1.7.4 · Red Hat

References

Advisory 1

Other 1

  • TI-2021-19622 Improper Preservation of Permissions in containerd CVSS 3.1CRITICAL 9.1
  • TI-2023-10635 containerd supplementary groups are not set up properly CVSS 3.1HIGH 7.8
  • TI-2022-07700 Insecure handling of image volumes in containerd CRI plugin CVSS 3.1HIGH 7.5
  • TI-2026-38569 containerd CRI checkpoint restore CDI annotation smuggling CVSS 4.0HIGH 8.4
  • TI-2025-29820 Containerd vulnerable to host filesystem access during image unpack CVSS 4.0HIGH 7.6
  • TI-2026-38568 containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore CVSS 4.0HIGH 8.2
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences