CVE-2026-53489 containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore
Attackers can read arbitrary host files via symlink following in CRI checkpoint restore, impacting container runtime security.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53489?
CVE-2026-53489 is a high-severity path traversal vulnerability in containerd, published on 1 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.
Weakness: CWE-61
Which versions are affected by CVE-2026-53489?
8 open source packages ship an affected version, including github.com/containerd/containerd/v2 and github.com/containerd/containerd. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/containerd/containerd/v2 Go | From 2.1.0 | 2.1.9, 2.2.5, 2.3.2 |
github.com/containerd/containerd/v2 Go | From 2.1.0 | 2.1.9 |
github.com/containerd/containerd/v2 Go | From 2.1.0 | 2.1.9 |
github.com/containerd/containerd/v2 Go | From 2.2.0 | 2.2.5 |
github.com/containerd/containerd/v2 Go | From 2.2.0 | 2.2.5 |
github.com/containerd/containerd/v2 Go | From 2.3.0 | 2.3.2 |
2 more packages
github.com/containerd/containerd/v2 Go | From 2.3.0 | 2.3.2 |
github.com/containerd/containerd Go | All versions | None |
Products include Linuxfoundation Containerd.
How do I fix CVE-2026-53489?
Upgrade github.com/containerd/containerd/v2 to a fixed version for your release line: 2.1.9, 2.2.5 or 2.3.2.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-53489 being exploited?
There is no known exploitation of CVE-2026-53489 in the wild and no public exploit code.
Other vulnerabilities in containerd
- CVE-2026-53488 containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull
- CVE-2026-53492 containerd CRI checkpoint restore CDI annotation smuggling
- CVE-2025-47290 Containerd vulnerable to host filesystem access during image unpack
- CVE-2026-46680 containerd user ID handling bypass allows runAsNonRoot evasion
- CVE-2024-25621 containerd affected by a local privilege escalation via wide permissions on CRI directory
Sources
Also known as AZL-90173, BELL-CVE-2026-53489, CLEANSTART-2026-CQ80081, CLEANSTART-2026-GA67495, CLEANSTART-2026-ON16663, DEBIAN-CVE-2026-53489 and 174 more.