Vulnerability · Published Jul 1, 2026 · Assigned by GitHub_M

CVE-2026-53489containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore

High 8.2

In plain English

A high-severity security flaw in containerd from containerd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.2High

Exploit odds (30 days)0.2%top 93.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.24	containerd	2.3.2-r0	ALPINE-CVE-2026-53489
Debian:14	containerd	2.1.9+ds1-1	DEBIAN-CVE-2026-53489
Go	github.com/containerd/containerd	no fix listed	GO-2026-5622
Go	github.com/containerd/containerd/v2	2.1.9	GHSA-rgh6-rfwx-v388
Go	github.com/containerd/containerd/v2	2.1.9, 2.2.5, 2.3.2	GO-2026-5622
Go	github.com/containerd/containerd/v2	2.3.2	GHSA-rgh6-rfwx-v388
Go	github.com/containerd/containerd/v2	2.2.5	GHSA-rgh6-rfwx-v388
Ubuntu:22.04:LTS	containerd-app	2.2.1-0ubuntu1~22.04.2	UBUNTU-CVE-2026-53489
Ubuntu:24.04:LTS	containerd-app	2.2.1-0ubuntu1~24.04.3	UBUNTU-CVE-2026-53489
Ubuntu:25.10	containerd-app	2.2.1-0ubuntu1~25.10.2	UBUNTU-CVE-2026-53489
Ubuntu:26.04:LTS	containerd-app	2.2.2-0ubuntu1.1	UBUNTU-CVE-2026-53489
Ubuntu:25.10	containerd-stable	2.1.6-0ubuntu1~25.10.2	UBUNTU-CVE-2026-53489
Ubuntu:26.04:LTS	containerd-stable	2.2.2-0ubuntu1.1	UBUNTU-CVE-2026-53489

Affected products (as reported)

Vendor	Product	Versions
containerd	containerd	>= 2.1.0, < 2.1.9>= 2.2.0, < 2.2.5>= 2.3.0, < 2.3.2

Weakness: CWE-61 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

References

https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388 x_refsource_CONFIRM