Skip to content
OpenAdvisories

Package · Go

github.com/containerd/containerd/v2

15 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.8
    CVE-2026-95837

    containerd CRI plugin: Checkpoint restore bypasses destination security context

    containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination Containe…

    containerd containerd containerd github.com/containerd/containerd Debian Ubuntu Go
  • High 8.2
    CVE-2026-53489

    containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore

    containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on t…

    containerd containerd containerd github.com/containerd/containerd Debian Ubuntu Alpine Go
  • High 8.4
    CVE-2026-53492

    containerd CRI checkpoint restore CDI annotation smuggling

    containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. W…

    containerd containerd containerd github.com/containerd/containerd Debian Ubuntu Alpine Go
  • High 7.3
    CVE-2026-46680 Public exploit

    containerd user ID handling bypass allows runAsNonRoot evasion

    containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot eva…

    containerd containerd containerd containerd Debian Ubuntu Alpine Go
  • High 7.3
    CVE-2024-25621

    containerd affected by a local privilege escalation via wide permissions on CRI directory

    containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containe…

    containerd containerd containerd github.com/containerd/containerd Debian Ubuntu Go
  • High 7.6
    CVE-2025-47290

    Containerd vulnerable to host filesystem access during image unpack

    containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only …

    containerd containerd containerd github.com/containerd/containerd/v2 Alpine Go