p PatchFirst

CVE-2026-53489

CVE-2026-53489 · containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore

This page contains facts from public vulnerability sources. Check the original advisory before updating.

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.

CVSS 8.2 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: system · containers

Affected products and versions

  • containerd

    Versions
    • >= 2.1.0, < 2.1.9: Affected
    • >= 2.2.0, < 2.2.5: Affected
    • >= 2.3.0, < 2.3.2: Affected

    No fix published

  • containerd Debian:14

    Versions
    • 1.7.24~ds1-10
    • 1.7.24~ds1-6
    • 1.7.24~ds1-7
    • 1.7.24~ds1-8
    • 1.7.24~ds1-9
    • 2.1.4~ds2-2
    • 2.1.4~ds2-3
    • 2.1.4~ds2-4
    • 2.1.4~ds2-5
    • 2.1.4~ds2-6
    • 2.1.4~ds2-7
    • 2.1.4~ds2-8
    • 2.1.6+ds1-1
    Affected ranges
    • ECOSYSTEM: < 2.1.9+ds1-1

    Update to 2.1.9+ds1-1

  • containerd-app Ubuntu:22.04:LTS

    Versions
    • 1.7.2-0ubuntu1~22.04.1
    • 1.7.12-0ubuntu2~22.04.1
    • 1.7.24-0ubuntu1~22.04.1
    • 1.7.24-0ubuntu1~22.04.2
    • 1.7.27-0ubuntu1~22.04.1
    • 1.7.28-0ubuntu1~22.04.1
    • 2.2.1-0ubuntu1~22.04.1
    Affected ranges
    • ECOSYSTEM: < 2.2.1-0ubuntu1~22.04.2

    Update to 2.2.1-0ubuntu1~22.04.2

  • containerd-app Ubuntu:24.04:LTS

    Versions
    • 1.7.2-0ubuntu2
    • 1.7.12-0ubuntu1
    • 1.7.12-0ubuntu2
    • 1.7.12-0ubuntu3
    • 1.7.12-0ubuntu4
    • 1.7.12-0ubuntu4.1
    • 1.7.19-0ubuntu1~24.04.1
    • 1.7.19+really1.7.12-0ubuntu4.2
    • 1.7.24-0ubuntu1~24.04.1
    • 1.7.24-0ubuntu1~24.04.2
    • 1.7.27-0ubuntu1~24.04.1
    • 1.7.28-0ubuntu1~24.04.1
    • 1.7.28-0ubuntu1~24.04.2
    • 2.2.1-0ubuntu1~24.04.2
    Affected ranges
    • ECOSYSTEM: < 2.2.1-0ubuntu1~24.04.3

    Update to 2.2.1-0ubuntu1~24.04.3

  • containerd-app Ubuntu:25.10

    Versions
    • 2.0.2-0ubuntu2
    • 2.0.5-0ubuntu1
    • 2.1.3-0ubuntu2
    • 2.1.3-0ubuntu3
    • 2.1.3-0ubuntu3.1
    • 2.2.1-0ubuntu1~25.10.1
    Affected ranges
    • ECOSYSTEM: < 2.2.1-0ubuntu1~25.10.2

    Update to 2.2.1-0ubuntu1~25.10.2

  • containerd-stable Ubuntu:25.10

    Versions
    • 2.1.3-0ubuntu1
    • 2.1.6-0ubuntu1~25.10.1
    Affected ranges
    • ECOSYSTEM: < 2.1.6-0ubuntu1~25.10.2

    Update to 2.1.6-0ubuntu1~25.10.2

  • containerd-app Ubuntu:26.04:LTS

    Versions
    • 2.1.3-0ubuntu3
    • 2.2.1-0ubuntu1
    • 2.2.2-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 2.2.2-0ubuntu1.1

    Update to 2.2.2-0ubuntu1.1

  • containerd-stable Ubuntu:26.04:LTS

    Versions
    • 2.1.3-0ubuntu1
    • 2.1.5-0ubuntu1
    • 2.2.1-0ubuntu1
    • 2.2.2-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 2.2.2-0ubuntu1.1

    Update to 2.2.2-0ubuntu1.1

Original sources

Check your server →