Vulnerabilities

TI-2026-38568 CVE-2026-53489 · GHSA-rgh6-rfwx-v388

containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore

LOW 35

containerd is an open-source container runtime.

CVSS 4.0HIGH 8.2 Local No auth No interaction EPSS 0.00174 Published 2026-07-01 Partial fix · 2.1.9, 2.2.5 +1 CWE-61

TI-2026-38569 CVE-2026-53492 · GHSA-33vj-92qq-66hc

containerd CRI checkpoint restore CDI annotation smuggling

LOW 36

containerd is an open-source container runtime.

CVSS 4.0HIGH 8.4 Network Low privileges No interaction EPSS 0.00353 Published 2026-07-01 Partial fix · 2.1.9, 2.2.5 +1 CWE-20

TI-2026-36954 CVE-2026-50195 · GHSA-cvxm-645q-p574

containerd: CRI checkpoint import allows local image tag poisoning

LOW 25

containerd is an open-source container runtime.

CVSS 4.0MEDIUM 5.6 Network Low privileges No interaction EPSS 0.00303 Published 2026-07-01 Fixed in 2.1.9, 2.2.5 +1 CWE-345

TI-2026-34842 CVE-2026-47262 · GHSA-jpcc-p29g-p8mq

containerd image-triggered runtime DoS via unbounded group parsing

LOW 24

containerd is an open-source container runtime.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00265 Published 2026-07-01 Fixed in 1.7.33, 2.0.10 +3 CWE-400

TI-2026-34311 CVE-2026-46680 · GHSA-fqw6-gf59-qr4w

containerd user ID handling bypass allows runAsNonRoot evasion

LOW 33

containerd is an open-source container runtime.

CVSS 4.0HIGH 7.3 Local No auth User interaction EPSS 0.00163 Published 2026-07-01 Fixed in 1.7.32, 2.0.9 +2 CWE-269

TI-2026-38567 CVE-2026-53488 · GHSA-xhf5-7wjv-pqxp

Improper input validation in backstage containerd

MEDIUM 42

containerd is an open-source container runtime.

CVSS 4.0CRITICAL 9.4 Local No auth No interaction EPSS 0.00176 Published 2026-07-01 Partial fix · 1.7.33, 2.0.10 +3 CWE-20

TI-2025-39764 CVE-2025-64329 · GHSA-m6hq-p25p-ffr2

containerd CRI server: Host memory exhaustion through Attach goroutine leak

LOW 30

containerd is an open-source container runtime.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00171 Published 2025-11-07 Partial fix · 1.7.29, 2.0.7 +2 CWE-401

TI-2024-16849 CVE-2024-25621 · GHSA-pwhc-rpq9-4c8w

containerd affected by a local privilege escalation via wide permissions on CRI directory

LOW 35

containerd is an open-source container runtime.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00168 Published 2025-11-06 Partial fix · 1.7.29, 2.0.7 +2 CWE-279

TI-2025-29821 CVE-2025-47291 · GHSA-cxfp-7pvr-95ff

containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.

LOW 21

containerd is an open-source container runtime.

CVSS 4.0MEDIUM 4.6 Local No auth No interaction EPSS 0.0029 Published 2025-05-21 Fixed in 2.0.5 CWE-266

TI-2025-29820 CVE-2025-47290 · GHSA-cm76-qm8v-3j95

Containerd vulnerable to host filesystem access during image unpack

LOW 36

containerd is a container runtime.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00506 Published 2025-05-20 Fixed in 2.1.1 CWE-367

TI-2024-27047 CVE-2024-40635 · GHSA-265r-hfxg-fhmg

containerd has an integer overflow in User ID handling

LOW 34

containerd is an open-source container runtime.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00304 Published 2025-03-17 Partial fix · 1.6.38, 1.7.27 +1 CWE-190

TI-2023-10635 CVE-2023-25173 · GHSA-hmfx-3pcx-653p

containerd supplementary groups are not set up properly

HIGH 67

containerd is an open source container runtime.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00542 Published 2023-02-16 Partial fix · 1.5.18, 1.6.18 CWE-863

TI-2023-10615 CVE-2023-25153 · GHSA-259w-8hf6-59c2

containerd OCI image importer memory exhaustion

LOW 28

containerd is an open source container runtime.

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.00363 Published 2023-02-16 Partial fix · 1.5.18, 1.6.18 CWE-770

TI-2022-07531 CVE-2022-23471 · GHSA-2qjp-425j-52j9

containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leak

LOW 31

containerd is an open source container runtime.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01109 Published 2022-12-07 Fixed in 1.5.16, 1.6.12 CWE-400

TI-2022-13075 CVE-2022-31030 · GHSA-5ffw-gxpp-mxpf

containerd CRI plugin: Host memory exhaustion through ExecSync

LOW 25

containerd is an open source container runtime.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00387 Published 2022-06-06 Fixed in 1.5.13, 1.6.6 CWE-400

TI-2022-07700 CVE-2022-23648 · GHSA-crp2-qrr5-8pq7

Insecure handling of image volumes in containerd CRI plugin

MEDIUM 55

containerd is a container runtime available as a daemon for Linux and Windows.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.27392 Published 2022-03-03 Partial fix · 1.4.13, 1.5.10 +1 CWE-200

TI-2021-19622 CVE-2021-43816 · GHSA-mvff-h3cj-wj9c

Improper Preservation of Permissions in containerd

HIGH 74

containerd is an open source container runtime.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01809 Published 2022-01-05 Partial fix · 1.5.9 CWE-281

TI-2021-17944 CVE-2021-41103 · GHSA-c2h3-6mxw-7mvq

Insufficiently restricted permissions on plugin directories

LOW 35

containerd is an open source container runtime with an emphasis on simplicity, robustness and portability.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00518 Published 2021-10-04 Partial fix · 1.4.11, 1.5.7 CWE-22

TI-2021-12427 CVE-2021-32760 · GHSA-c72p-9xmj-rx3w

Archive package allows chmod of file outside of unpack target directory

LOW 31

containerd is a container runtime.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.01595 Published 2021-07-19 Partial fix · 1.4.8, 1.5.4 CWE-668

TI-2021-04434 CVE-2021-21334 · GHSA-6g2q-w5j3-fwh4

environment variable leak

LOW 32

In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that use…

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.01947 Published 2021-03-10 Fixed in 1.3.10, 1.4.4 CWE-668

TI-2020-12029 CVE-2020-15257 · GHSA-36xw-fx78-c5r4

containerd-shim API Exposed to Host Network Containers

LOW 29

containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows.

CVSS 3.1MEDIUM 5.2 Local Low privileges No interaction EPSS 0.03125 Published 2020-12-01 Partial fix · 1.3.9, 1.4.3 CWE-669

TI-2020-11929 CVE-2020-15157 · GHSA-742w-89gc-8m9c

containerd can be coerced into leaking credentials during image pull

LOW 32

In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02299 Published 2020-10-16 Partial fix · 1.2.14 CWE-522

Vulnerabilities

Filters