containerd CRI checkpoint restore CDI annotation smuggling
Priority LOW 36CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 17 fixed, 26 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.
Summary
containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations from the checkpoint archive rather than relying solely on the pod's create-time specification. This allows a user with pod creation permissions to bypass standard Kubernetes resource allocation and device plugin enforcement, injecting arbitrary CDI edits (such as device nodes and host mounts) into the restored container. Successful exploitation requires that the node has CDI enabled and contains a matching host CDI specification for the requested device; environments where CDI is disabled or lacking sensitive device specifications are not affected. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00353 29th percentileScored 2026-11-07
Fix Partial containerd (containerd): 2.1.9, 2.2.5, 2.3.2github.com/containerd/containerd/v2 (Go): 2.1.9, 2.2.5, 2.3.2Red Hat: 20 advisoriesRed Hat: 17 fixed, 26 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | containerd | 2.1.0 to before 2.1.9; 2.2.0 to before 2.2.5; 2.3.0 to before 2.3.2 | 2.1.9, 2.2.5, 2.3.2 | Patch available | CNA |
| — | github.com/containerd/containerd/v2 (Go) | 2.1.0 to before 2.1.9 | 2.1.9 | Patch available | GHSA-33vj-92qq-66hc |
| — | github.com/containerd/containerd/v2 (Go) | 2.2.0 to before 2.2.5 | 2.2.5 | Patch available | GHSA-33vj-92qq-66hc |
| — | github.com/containerd/containerd/v2 (Go) | 2.3.0 to before 2.3.2 | 2.3.2 | Patch available | GHSA-33vj-92qq-66hc |
- containerd Vendorbackstage Affected 2.1.0 to before 2.1.9; 2.2.0 to before 2.2.5; 2.3.0 to before 2.3.2 Fixed in 2.1.9, 2.2.5, 2.3.2 Patch available CNA
- github.com/containerd/containerd/v2 (Go) Vendor— Affected 2.1.0 to before 2.1.9 Fixed in 2.1.9 Patch available GHSA-33vj-92qq-66hc
- github.com/containerd/containerd/v2 (Go) Vendor— Affected 2.2.0 to before 2.2.5 Fixed in 2.2.5 Patch available GHSA-33vj-92qq-66hc
- github.com/containerd/containerd/v2 (Go) Vendor— Affected 2.3.0 to before 2.3.2 Fixed in 2.3.2 Patch available GHSA-33vj-92qq-66hc
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* | 2.1.0 to before 2.1.9; 2.2.0 to before 2.2.5; 2.3.0 to before 2.3.2 | Vulnerable | backstage |
- cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* Versions 2.1.0 to before 2.1.9; 2.2.0 to before 2.2.5; 2.3.0 to before 2.3.2 Vulnerable ·backstage
Remediation
- Fix · CNA containerd (containerd) Fixed in 2.1.9, 2.2.5, 2.3.2
- Fix · GHSA-33vj-92qq-66hc github.com/containerd/containerd/v2 (Go) Fixed in 2.1.9 Advisory →
- Fix · GHSA-33vj-92qq-66hc github.com/containerd/containerd/v2 (Go) Fixed in 2.2.5 Advisory →
- Fix · GHSA-33vj-92qq-66hc github.com/containerd/containerd/v2 (Go) Fixed in 2.3.2 Advisory →
Red Hat 20 advisories
- RHSA-2026:71179 Released 2026-09-23 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9 +10
- RHSA-2026:71177 Released 2026-09-23 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.7 Container Release Update
- Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/aap-must-gather-rhel9, registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9 +4
- RHSA-2026:66022 Released 2026-09-09 · Red Hat rating ImportantRed Hat OpenShift API for Data Protection
- OpenShift API for Data Protection 1.5 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +4
Show 17 more Red Hat advisories
- RHSA-2026:62260 Released 2026-09-01 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.30.0 Release.
- Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
- RHSA-2026:59467 Released 2026-08-25 · Red Hat rating ImportantRed Hat OpenShift API for Data Protection
- OpenShift API for Data Protection 1.4 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +3
- RHSA-2026:57013 Released 2026-08-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.20.17 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
- RHSA-2026:56366 Released 2026-08-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.19.22 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
- RHSA-2026:53530 Released 2026-08-11 · Red Hat rating CriticalMulticluster Global Hub 1.7.2 security update
- Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:52946 Released 2026-08-10 · Red Hat rating CriticalMulticluster Global Hub 1.8.1 security update
- Multicluster Global Hub 1.8.2 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator
- RHSA-2026:51033 Released 2026-08-06 · Red Hat rating ImportantRed Hat OpenShift API for Data Protection
- OpenShift API for Data Protection 1.3 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +7
- RHSA-2026:48913 Released 2026-07-30 · Red Hat rating ImportantRHACS 4.10.6 security and bug fix update
- Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator
- RHSA-2026:48872 Released 2026-07-30 · Red Hat rating ImportantRHACS 4.9.10 security and bug fix update
- Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-rhel8
- RHSA-2026:47149 Released 2026-07-28 · Red Hat rating ImportantMulticluster Global Hub 1.7.2 security update
- Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:44622 Released 2026-07-23 · Red Hat rating ImportantMulticluster Global Hub 1.6.4 security update
- Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:42852 Released 2026-07-21 · Red Hat rating ImportantMulticluster Global Hub 1.5.6 security update
- Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:41030 Released 2026-07-16 · Red Hat rating ImportantMulticluster Global Hub 1.4.7 security update
- Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:36873 Released 2026-07-08 · Red Hat rating ImportantSubmariner v0.20 security fixes and container updates
- Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/lighthouse-agent-rhel9, registry.redhat.io/rhacm2/lighthouse-coredns-rhel9, registry.redhat.io/rhacm2/nettest-rhel9 +5
- RHSA-2026:32974 Released 2026-06-29 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images syft-1.46.0-0.1.hum1@aarch64, syft-1.46.0-0.1.hum1@src, syft-1.46.0-0.1.hum1@x86_64
- RHSA-2026:32963 Released 2026-06-29 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images grype-0.115.0-0.1.hum1@aarch64, grype-0.115.0-0.1.hum1@src, grype-0.115.0-0.1.hum1@x86_64
- RHSA-2026:15862 Released 2026-05-09 · Red Hat rating CriticalRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images trivy-0.69.3-1.2.hum1@aarch64, trivy-0.69.3-1.2.hum1@src, trivy-0.69.3-1.2.hum1@x86_64
Vendor assessments
Red Hat
Red Hat rating: Critical. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Affected | No fix planned: Will not fix |
| Confidential Compute Attestation | Affected | No fix planned: Will not fix |
| Deployment Validation Operator | Affected | No fix yet |
| Exploit Intelligence | Affected | No fix yet |
| Kernel Module Management Operator for Red Hat Openshift | Affected | No fix yet |
| MCP Server for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| Machine Deletion Remediation Operator | Affected | No fix yet |
| Migration Toolkit for Virtualization | Affected | No fix planned: Will not fix |
| Multicluster Engine for Kubernetes | Affected | No fix planned: Will not fix |
| Node HealthCheck Operator | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix yet: Fix deferred |
| OpenShift Lightspeed | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| OpenShift Service Mesh 2 | Affected | No fix planned: Will not fix |
| Pen Drive Powered by Red Hat Lightspeed | Affected | No fix yet: Fix deferred |
| Power monitoring for Red Hat OpenShift | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 6 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat Trusted Artifact Signer | Affected | No fix yet |
| Multicluster Global Hub 1.4.9 | Fixed | RHSA-2026:41030 |
| Multicluster Global Hub 1.5.8 | Fixed | RHSA-2026:42852 |
| Multicluster Global Hub 1.6.6 | Fixed | RHSA-2026:44622 |
| Multicluster Global Hub 1.7.4 | Fixed | RHSA-2026:47149, RHSA-2026:53530 |
| Multicluster Global Hub 1.8.2 | Fixed | RHSA-2026:52946 |
| OpenShift API for Data Protection 1.3 | Fixed | RHSA-2026:51033 |
| OpenShift API for Data Protection 1.4 | Fixed | RHSA-2026:59467 |
| OpenShift API for Data Protection 1.5 | Fixed | RHSA-2026:66022 |
| Red Hat Advanced Cluster Management for Kubernetes 2.13 | Fixed | RHSA-2026:36873 |
| Red Hat Advanced Cluster Security 4.9 | Fixed | RHSA-2026:48872 |
| Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 | Fixed | RHSA-2026:48913 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:71179 |
| Red Hat Ansible Automation Platform 2.7 | Fixed | RHSA-2026:71177 |
| Red Hat Hardened Images | Fixed | RHSA-2026:15862, RHSA-2026:32963, RHSA-2026:32974 |
| Red Hat OpenShift Dev Spaces 3.30 | Fixed | RHSA-2026:62260 |
| Red Hat Openshift Data Foundation 4.19 | Fixed | RHSA-2026:56366 |
| Red Hat Openshift Data Foundation 4.20 | Fixed | RHSA-2026:57013 |
Not affected: 40 products
- Assisted Installer for Red Hat OpenShift Container Platform 2
- Gatekeeper 3
- Logging Subsystem for Red Hat OpenShift
- Logical Volume Manager Storage
- Migration Toolkit for Containers
- Multicluster Engine for Kubernetes
- Multicluster Global Hub 1.4.9
- Multicluster Global Hub 1.5.8
- Multicluster Global Hub 1.6.6
- Multicluster Global Hub 1.7.4
- Multicluster Global Hub 1.8.2
- OpenShift API for Data Protection 1.3
- OpenShift API for Data Protection 1.4
- OpenShift API for Data Protection 1.5
- OpenShift Developer Tools and Services
- OpenShift Lightspeed
- OpenShift Service Mesh 3
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Red Hat Advanced Cluster Security 4
- Red Hat Advanced Cluster Security 4.9
- Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.7
- Red Hat Build of Kueue
- Red Hat Enterprise Linux 8
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Dev Spaces 3.30
- Red Hat OpenShift GitOps
- Red Hat OpenShift Virtualization 4
- Red Hat OpenShift for Windows Containers
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0
- Red Hat Openshift Data Foundation 4.19
- Red Hat Openshift Data Foundation 4.20
- Red Hat Trusted Profile Analyzer
Timeline
- 2026-10-02 Threatist record created from CVE-2026-53492
- 2026-10-03 Alias added: GHSA-33vj-92qq-66hc
- 2026-10-26 Affected versions changed · Red Hat
- 2026-11-01 Affected versions changed · Red Hat
- 2026-11-05 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat
- 2026-11-06 Fix available: RHSA-2026:71177 · Red Hat
- 2026-11-06 Fix available: Multicluster Global Hub 1.7.4 · Red Hat
References
More backstage Containerd vulnerabilities
- TI-2021-19622 Improper Preservation of Permissions in containerd CVSS 3.1CRITICAL 9.1
- TI-2023-10635 containerd supplementary groups are not set up properly CVSS 3.1HIGH 7.8
- TI-2022-07700 Insecure handling of image volumes in containerd CRI plugin CVSS 3.1HIGH 7.5
- TI-2026-38567 Improper input validation in backstage containerd CVSS 4.0CRITICAL 9.4
- TI-2025-29820 Containerd vulnerable to host filesystem access during image unpack CVSS 4.0HIGH 7.6
- TI-2026-38568 containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore CVSS 4.0HIGH 8.2
Sources
- CVE-2026-53492 · CVE Program
- CVE-2026-53492 · NVD
- FIRST EPSS
- GHSA-33vj-92qq-66hc · GitHub Advisory Database · CC BY 4.0
- CVE-2026-53492 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences