CVE-2026-53488
Published Jul 1, 2026
Last updated 2 months ago
CVSS critical 9.4
AWS
Cloud
Container Security
- Description
- containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
- Products
- containerd
CVSS 4.0
- Type
- Secondary
- Base score
- 9.4
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- CRITICAL
CVSS 3.1
- Type
- Primary
- Base score
- 8.8
- Impact score
- 6
- Exploitability score
- 2
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Severity
- HIGH
- security-advisories@github.com
- CWE-20
- Hype score
- Not currently trending
🚨Critical - containerd CRI Plugin Multiple Vulnerabilities (CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262) AWS disclosed five flaws in the containerd CRI plugin (v1.7–2.3), the runtime behind EKS, ECS, Fargate, GKE and self-managed Kubernete
@UpwindMDR
1 Jul 2026
98 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
1 Quote
Containerdで重大(Critical)な脆弱性3件が修正。ホストでの任意コード実行が可能となるもの。チェックポイントレストア契機のCVE-2026-53492、イメージプル契機のCVE-2026-53488、チェックポイントイメージからのCVE-2026-
@__kokumoto
24 Jun 2026
658 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*",
"matchCriteriaId": "332FFED6-429A-4A38-A075-95EB8D219A5A",
"versionEndExcluding": "1.7.33",
"versionStartIncluding": "1.7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C140AEF7-7C5A-4219-B732-F93CCAE69FF6",
"versionEndExcluding": "2.0.10",
"versionStartIncluding": "2.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A83AFFD7-0DA1-43A4-88AC-2E56305B70D1",
"versionEndExcluding": "2.1.9",
"versionStartIncluding": "2.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B62A9FED-C400-4641-AE8B-AE7594307011",
"versionEndExcluding": "2.2.5",
"versionStartIncluding": "2.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B45FCE68-7923-499A-9059-1483851FCADE",
"versionEndExcluding": "2.3.2",
"versionStartIncluding": "2.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]