Description
containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| containerd | containerd | >= 2.1.0, < 2.1.9, >= 2.2.0, < 2.2.5, >= 2.3.0, < 2.3.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | containerd | 2.1.9+ds1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | containerd-app +1 | 2.2.2-0ubuntu1.1 | — |
| Ubuntu 25.10 | containerd-app | 2.2.1-0ubuntu1~25.10.2 | — |
| Ubuntu 25.10 | containerd-stable | 2.1.6-0ubuntu1~25.10.2 | — |
| Ubuntu 24.04 LTS | containerd-app | 2.2.1-0ubuntu1~24.04.3 | — |
| Ubuntu 22.04 LTS | containerd-app | 2.2.1-0ubuntu1~22.04.2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grype | 0.115.0-0.1.hum1 | RHSA-2026:32963 |
| Red Hat Hardened Images 1 | syft | 1.46.0-0.1.hum1 | RHSA-2026:32974 |
| Red Hat Hardened Images 1 | trivy | 0.69.3-1.2.hum1 | RHSA-2026:15862 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | trivy | 0.71.2-1.1 | openSUSE-SU-2026:11102-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 16.0 | trivy | 0.71.2-160000.1.1 | openSUSE-SU-2026:21072-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | containerd | 2.3.2-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | containerd +1 | 2.2.4-1.amzn2023.0.3 | ALAS2023-2026-1897 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | containerd2 | 2.2.4-3 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | buildctl +1 | 0.31.0-r2 | — |
| Wolfi rolling | chartmuseum | 0.16.5-r15 | — |
| Wolfi rolling | cluster-api-helm-controller | 0.6.4-r8 | — |
| Wolfi rolling | consul-k8s-1.9-cli | 1.9.9-r0 | — |
| Wolfi rolling | ctop | 0.7.7-r38 | — |
| Wolfi rolling | ctr-1 +3 | 1.7.33-r1 | — |
| Wolfi rolling | dagger | 0.20.8-r9 | — |
| Wolfi rolling | docker-cli-buildx | 0.35.0-r1 | — |
| Wolfi rolling | docker-compose | 5.1.4-r6 | — |
| Wolfi rolling | dockerd-28 +4 | No fix yet | — |
| Wolfi rolling | dockerd-29 | 29.6.0-r1 | — |
| Wolfi rolling | dogstatsd-7.72 +1 | 7.72.4-r30 | — |
| Wolfi rolling | dogstatsd-7.73 +1 | 7.73.3-r19 | — |
| Wolfi rolling | dogstatsd-7.77 +1 | 7.77.3-r18 | — |
| Wolfi rolling | dogstatsd-7.78 +1 | 7.78.4-r12 | — |
| Wolfi rolling | dogstatsd-7.79 +1 | 7.79.2-r8 | — |
| Wolfi rolling | eksctl | 0.229.0-r1 | — |
| Wolfi rolling | envoy-gateway-egctl | 1.8.2-r0 | — |
| Wolfi rolling | falco-no-driver | 0.45.0-r0 | — |
| Wolfi rolling | fuse-overlayfs-snapshotter | 2.1.7-r17 | — |
| Wolfi rolling | grype | 0.114.0-r1 | — |
| Wolfi rolling | headlamp | 0.43.0-r3 | — |
| Wolfi rolling | helm-3 | 3.21.2-r2 | — |
| Wolfi rolling | helm-mapkubeapis | 0.6.1-r21 | — |
| Wolfi rolling | helm-operator +1 | 1.42.3-r0 | — |
| Wolfi rolling | helm-push | 0.11.1-r16 | — |
| Wolfi rolling | helm-set-status | 0.3.0-r21 | — |
| Wolfi rolling | k3s-static | 1.36.2.1-r1 | — |
| Wolfi rolling | k3s-static-1.34 | 1.34.9.1-r1 | — |
| Wolfi rolling | k3s-static-1.35 | 1.35.6.1-r1 | — |
| Wolfi rolling | k8sgpt | 0.4.38-r3 | — |
| Wolfi rolling | k8ssandra-client | 0.9.1-r2 | — |
| Wolfi rolling | k9s | 0.51.0-r1 | — |
| Wolfi rolling | kaniko +1 | 1.25.15-r9 | — |
| Wolfi rolling | kargo | 1.10.8-r1 | — |
| Wolfi rolling | kots | 1.130.6-r0 | — |
| Wolfi rolling | kube-arangodb-1.4 | 1.4.3-r13 | — |
| Wolfi rolling | kubescape | 4.0.9-r1 | — |
| Wolfi rolling | kubescape-operator | 0.2.151-r4 | — |
| Wolfi rolling | kubevela-vela-cli +1 | 1.10.9-r0 | — |
| Wolfi rolling | linkerd2-cli +4 | 26.6.3-r2 | — |
| Wolfi rolling | linkerd2-debug +1 | 26.9.2-r0 | — |
| Wolfi rolling | manifest-tool | 2.2.2-r4 | — |
| Wolfi rolling | neuvector-scanner +1 | 4.199-r1 | — |
| Wolfi rolling | newrelic-infrastructure-agent | 1.77.1-r0 | — |
| Wolfi rolling | rancher-2.13 +1 | 2.13.7-r0 | — |
| Wolfi rolling | rancher-2.14 | 2.14.3-r1 | — |
| Wolfi rolling | rancher-agent-2.14 | 2.14.3-r0 | — |
| Wolfi rolling | rancher-helm-3 | 3.20.0-r15 | — |
| Wolfi rolling | scorecard | 5.5.0-r10 | — |
| Wolfi rolling | skaffold | 2.23.0-r0 | — |
| Wolfi rolling | spegel | 0.7.2-r2 | — |
| Wolfi rolling | steampipe | 2.4.4-r7 | — |
| Wolfi rolling | syft | 1.45.1-r1 | — |
| Wolfi rolling | teleport-18.6 | 18.6.8-r30 | — |
| Wolfi rolling | trivy | 0.70.0-r7 | — |
| Wolfi rolling | trivy-operator | 0.30.1-r16 | — |
| Wolfi rolling | tw +1 | 0.0.50-r0 | — |
| Wolfi rolling | wolfictl | 0.39.18-r2 | — |
| Wolfi rolling | xeol | 0.10.8-r47 | — |
| Wolfi rolling | zarf | 0.79.0-r1 | — |
| Wolfi rolling | zot | 2.1.17-r7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/containerd/containerd | all versions | — | GO-2026-5622 |
| Go | github.com/containerd/containerd/v2 | >= 2.1.0, < 2.1.9 | 2.1.9 | GHSA-rgh6-rfwx-v388 |
| Go | github.com/containerd/containerd/v2 | >= 2.2.0, < 2.2.5 | 2.2.5 | GHSA-rgh6-rfwx-v388 |
| Go | github.com/containerd/containerd/v2 | >= 2.3.0, < 2.3.2 | 2.3.2 | GHSA-rgh6-rfwx-v388 |
| Go | github.com/containerd/containerd/v2 | >= 2.1.0, < 2.1.9 · >= 2.2.0, < 2.2.5 · >= 2.3.0, < 2.3.2 | 2.1.9, 2.2.5, 2.3.2 | GO-2026-5622 |
Advisories 8
- WID-SEC-2026-2009 Google Cloud Platform (GKE containerd): Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 27, 2026
- RHSA-2026:32974 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:32963 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:15862 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- openSUSE-SU-2026:21072-1 Security update for trivy SUSE / openSUSE Security Updates · Jun 30, 2026
- ALAS2023-2026-1897 Important: containerd security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 24, 2026
- openSUSE-SU-2026:11102-1 trivy-0.71.2-1.1 on GA media SUSE / openSUSE Security Updates · Jun 24, 2026