CVE-2026-53488 containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull
Attackers can execute arbitrary host commands by exploiting unvalidated image labels in the containerd CRI plugin, requiring an upgrade to secure the runtime.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53488?
CVE-2026-53488 is a critical command injection vulnerability in containerd, published on 1 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.
Weakness: CWE-20
Which versions are affected by CVE-2026-53488?
12 open source packages ship an affected version, including github.com/containerd/containerd/v2 and github.com/containerd/containerd. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/containerd/containerd/v2 Go | From 2.0.0 | 2.0.10, 2.1.9, 2.2.5, 2.3.2 |
github.com/containerd/containerd/v2 Go | From 2.0.0 | 2.0.10 |
github.com/containerd/containerd/v2 Go | From 2.0.0 | 2.0.10 |
github.com/containerd/containerd/v2 Go | From 2.1.0 | 2.1.9 |
github.com/containerd/containerd/v2 Go | From 2.1.0 | 2.1.9 |
github.com/containerd/containerd/v2 Go | From 2.2.0 | 2.2.5 |
6 more packages
github.com/containerd/containerd/v2 Go | From 2.2.0 | 2.2.5 |
github.com/containerd/containerd/v2 Go | From 2.3.0 | 2.3.2 |
github.com/containerd/containerd/v2 Go | From 2.3.0 | 2.3.2 |
github.com/containerd/containerd Go | From 1.7.0 | 1.7.33 |
github.com/containerd/containerd Go | From 1.7.0 | 1.7.33 |
github.com/containerd/containerd Go | From 1.7.0 | 1.7.33 |
Linux distribution packages (17)
containerd SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 1.7.29-150000.149.1 |
containerd SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 1.7.29-150000.149.1 |
containerd SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 1.7.29-150000.149.1 |
containerd SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 1.7.29-150000.149.1 |
containerd SUSE:Linux Enterprise Micro 5.3 | All versions | 1.7.29-150000.149.1 |
containerd SUSE:Linux Enterprise Micro 5.4 | All versions | 1.7.29-150000.149.1 |
containerd SUSE:Linux Enterprise Micro 5.5 | All versions | 1.7.29-150000.149.1 |
containerd SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.7.29-150000.149.1 |
containerd SUSE:Linux Enterprise Module for Containers 15 SP7 | All versions | 1.7.29-150000.149.1 |
containerd SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 1.7.29-16.116.1 |
containerd SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 1.7.29-150000.149.1 |
containerd SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 1.7.29-150000.149.1 |
containerd SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 1.7.29-150000.149.1 |
containerd SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 1.7.29-16.116.1 |
containerd SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 1.7.29-150000.149.1 |
containerd SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 1.7.29-150000.149.1 |
containerd SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 1.7.29-150000.149.1 |
Products include Linuxfoundation Containerd.
How do I fix CVE-2026-53488?
Upgrade github.com/containerd/containerd/v2 to a fixed version for your release line: 2.0.10, 2.1.9, 2.2.5 or 2.3.2.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-53488 being exploited?
There is no known exploitation of CVE-2026-53488 in the wild and no public exploit code.
Other vulnerabilities in containerd
- CVE-2026-53492 containerd CRI checkpoint restore CDI annotation smuggling
- CVE-2026-53489 containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore
- CVE-2025-47290 Containerd vulnerable to host filesystem access during image unpack
- CVE-2026-46680 containerd user ID handling bypass allows runAsNonRoot evasion
- CVE-2024-25621 containerd affected by a local privilege escalation via wide permissions on CRI directory
Sources
Also known as AZL-90167, AZL-91584, AZL-91587, BELL-CVE-2026-53488, CLEANSTART-2026-DF92501, CLEANSTART-2026-NA18858 and 222 more.