CVE-2026-46680: containerd user ID handling bypass allows runAsNonRoot evasion

Analyzed

AliasesUBUNTU-CVE-2026-46680DEBIAN-CVE-2026-46680CGA-23h2-w9h8-c7fh+581 more

Published 01-07-2026Last modified 03-07-2026

Vulnerability summary

CVE-2026-46680 is a high (CVSS 7.8) Improper Privilege Management vulnerability in containerd. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 5.5% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 7.3, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.8/10

010

High · v3.1 (NVD)

EPSS score

0.16%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 5

OPENSUSE-SU-2026:11107-1 OPENSUSE-SU-2026:21072-1 OPENSUSE-SU-2026:21213-1 OPENSUSE-SU-2026:21483-1 RHSA-2026:35111 CGA-68JQ-G8QJ-2MRH

Timeline

01-07-2026
PublishedVulnerability first disclosed.
03-07-2026
Last modifiedVulnerability information updated.

Description

containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the Kubernetes runAsNonRoot restriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user. This issue has been fixed in versions 1.7.32, 2.0.9, 2.2.4 and 2.3.1.

CVSS metrics

11 scores · 8 sources · 2 versions

v4.07.3v3.17.8

EPSS trend

Probability

0.16%

Chance of exploitation in the next 30 days

Percentile

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.16% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected systems

Version check

Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

amazon-ecs-agent< 1.103.1-r2
amazon-ecs-agent-fips< 1.103.1-r2
auditbeat-7All versions (No fix recorded)
auditbeat-fips-7All versions (No fix recorded)
buildctl< 0.30.0-r1

buildctl-fips< 0.30.0-r2
buildkitd< 0.30.0-r1
buildkitd-fips< 0.30.0-r2
cg< 0.2.264-r1
chainctl< 0.2.264-r2
chainctl-fips< 0.2.265-r0
chaos-mesh< 2.8.2-r8
chaos-mesh-daemon< 2.8.2-r8
chaos-mesh-dashboard< 2.8.2-r8
chaos-mesh-fips< 2.8.2-r9
chaos-mesh-fips-daemon< 2.8.2-r9
chaos-mesh-fips-dashboard< 2.8.2-r9
chartmuseum< 0.16.5-r9
chartmuseum-fips< 0.16.5-r8
cloudbeat-8.17< 8.17.10-r21
cloudbeat-8.19< 8.19.15-r4
cloudbeat-9.0< 9.0.8-r24
cloudbeat-9.1< 9.1.10-r16
cloudbeat-9.2< 9.2.8-r4
cloudbeat-9.3< 9.3.4-r6
cloudbeat-9.4< 9.4.1-r2
cloudbeat-fips-8.17< 8.17.10-r26
cloudbeat-fips-8.19< 8.19.15-r2
cloudbeat-fips-9.0< 9.0.8-r27
cloudbeat-fips-9.1< 9.1.10-r19
cloudbeat-fips-9.2< 9.2.8-r3
cloudbeat-fips-9.3< 9.3.4-r5
cloudbeat-fips-9.4< 9.4.1-r2
cluster-api-helm-controller< 0.6.4-r2
cluster-api-helm-controller-fips< 0.6.4-r2
consul-k8s-1.1-cli< 1.1.18-r38
consul-k8s-1.3-cli< 1.3.9-r41
consul-k8s-1.4-cli< 1.4.10-r25
consul-k8s-1.5-cli< 1.5.9-r27
consul-k8s-1.6-cli< 1.6.10-r19
consul-k8s-1.7-cli< 1.7.13-r7
consul-k8s-1.9-cli< 1.9.7-r4
consul-k8s-fips-1.1-cli< 1.1.18-r37
consul-k8s-fips-1.3-cli< 1.3.9-r36
consul-k8s-fips-1.4-cli< 1.4.10-r26
consul-k8s-fips-1.5-cli< 1.5.9-r28
consul-k8s-fips-1.6-cli< 1.6.10-r20
consul-k8s-fips-1.7-cli< 1.7.13-r10
consul-k8s-fips-1.9-cli< 1.9.7-r3
containerd-2< 2.3.1-r0
containerd-2.1All versions (No fix recorded)
containerd-fips< 2.3.1-r0
containerd-shim-runc-v2-2< 2.3.1-r0
containerd-shim-runc-v2-2.1All versions (No fix recorded)
containerd-shim-runc-v2-fips< 2.3.1-r0
containerd-stress-2< 2.3.1-r0
containerd-stress-2.1All versions (No fix recorded)
containerd-stress-fips< 2.3.1-r0
ctop< 0.7.7-r35
ctr-2< 2.3.1-r0
ctr-2.1All versions (No fix recorded)
ctr-fips< 2.3.1-r0
dagger< 0.20.8-r5
datadog-agent-7.71< 7.71.2-r27
datadog-agent-7.72< 7.72.4-r28
datadog-agent-7.73< 7.73.3-r19
datadog-agent-7.74< 7.74.1-r20
datadog-agent-7.75All versions (No fix recorded)
datadog-agent-7.76< 7.76.3-r41 | All versions (No fix recorded) | < 7.76.3-r18
datadog-agent-7.77< 7.77.3-r13
datadog-agent-7.78< 7.78.4-r8
datadog-agent-fips-7.71< 7.71.2-r21
datadog-agent-fips-7.72< 7.72.4-r28
datadog-agent-fips-7.73< 7.73.3-r19
datadog-agent-fips-7.74< 7.74.1-r21
datadog-agent-fips-7.75All versions (No fix recorded)
datadog-agent-fips-7.76< 7.76.3-r17
datadog-agent-fips-7.77< 7.77.3-r11
datadog-agent-fips-7.78< 7.78.4-r5
docker-cli-buildx< 0.34.1-r1
docker-cli-buildx-fips< 0.34.1-r1
docker-compose< 5.1.4-r1
docker-compose-fips< 5.1.4-r1
dockerd-28All versions (No fix recorded)
dockerd-29< 29.5.2-r1
dockerd-fips-28All versions (No fix recorded)
dockerd-fips-29< 29.5.2-r1
dogstatsd-7.71< 7.71.2-r27
dogstatsd-7.72< 7.72.4-r28
dogstatsd-7.73< 7.73.3-r19
dogstatsd-7.74< 7.74.1-r20
dogstatsd-7.75All versions (No fix recorded)
dogstatsd-7.76< 7.76.3-r18
dogstatsd-7.77< 7.77.3-r13
dogstatsd-7.78< 7.78.4-r8
eks-node-monitoring-agent< 1.6.5-r1
eks-node-monitoring-agent-fips< 1.6.5-r1
eksctl< 0.226.0-r2
envoy-gateway-egctl< 1.8.0-r1
envoy-gateway-fips-egctl< 1.8.0-r2
falco-no-driver< 0.45.0-r0
filebeat-7All versions (No fix recorded)
filebeat-fips-7All versions (No fix recorded)
filebeat-oss-7All versions (No fix recorded)
filebeat-oss-fips-7All versions (No fix recorded)
fuse-overlayfs-snapshotter< 2.1.7-r14
gatekeeper-3.20-gatorAll versions (No fix recorded)
gatekeeper-3.21-gator< 3.21.1-r10
gitlab-rails-ce-18.1All versions (No fix recorded)
gitlab-rails-ce-18.10< 18.10.6-r2
gitlab-rails-ce-18.11< 18.11.3-r2
gitlab-rails-ce-18.4All versions (No fix recorded)
gitlab-rails-ce-18.5All versions (No fix recorded)
gitlab-rails-ce-18.6All versions (No fix recorded)
gitlab-rails-ce-18.7All versions (No fix recorded)
gitlab-rails-ce-18.8All versions (No fix recorded)
gitlab-rails-ce-18.9All versions (No fix recorded)
gitlab-rails-ce-19.0< 19.0.1-r4
gitlab-rails-ce-fips-18.1< 18.1.6-r13
gitlab-rails-ce-fips-18.10< 18.10.6-r3
gitlab-rails-ce-fips-18.11< 18.11.3-r3
gitlab-rails-ce-fips-18.4All versions (No fix recorded)
gitlab-rails-ce-fips-18.5All versions (No fix recorded)
gitlab-rails-ce-fips-18.6All versions (No fix recorded)
gitlab-rails-ce-fips-18.7All versions (No fix recorded)
gitlab-rails-ce-fips-18.8All versions (No fix recorded)
gitlab-rails-ce-fips-18.9All versions (No fix recorded)
gitlab-rails-ce-fips-19.0< 19.0.1-r3
gogatekeeper< 4.9.0-r1
google-osconfig-agent< 20251028.00-r19
grype< 0.112.0-r4
grype-db< 0.53.3-r4
grype-fips< 0.112.0-r4
headlamp< 0.42.0-r3
headlamp-fips< 0.42.0-r4
heartbeat-7All versions (No fix recorded)
heartbeat-fips-7All versions (No fix recorded)
helm-3< 3.21.0-r1 | < 3.22.0-r0
helm-exporter< 1.3.0-r8
helm-exporter-fips< 1.3.0-r8
helm-fips-3< 3.21.0-r2
helm-mapkubeapis< 0.6.1-r18
helm-operator< 1.42.2-r7
helm-operator-fips< 1.42.2-r5
helm-push< 0.11.1-r11
helm-set-status< 0.3.0-r17
jfrog-cli< 2.104.1-r1
k3s-static< 1.36.1.1-r1
k3s-static-1.32< 1.32.13.1-r21
k3s-static-1.33< 1.33.12.1-r4
k3s-static-1.34< 1.34.9.1-r0
k3s-static-1.35< 1.35.3.1-r12
k8sgpt< 0.4.33-r3
k8ssandra-client< 0.8.11-r4
k8ssandra-client-fips< 0.8.11-r3
k9s< 0.50.18-r26
k9s-fips< 0.50.18-r20
kaniko< 1.25.15-r2
kaniko-fips< 1.25.15-r2
kaniko-warmer< 1.25.15-r2
kaniko-warmer-fips< 1.25.15-r2
kargo< 1.10.4-r2
kgateway-2.4< 2.4.2-r1
kgateway-fips-2.4< 2.4.2-r1
kots< 1.130.4-r1
kube-arangodb-1.3All versions (No fix recorded)
kube-arangodb-1.4< 1.4.3-r5
kube-arangodb-fips-1.3All versions (No fix recorded)
kube-arangodb-fips-1.4< 1.4.3-r3
kube-mgmt< 11.0.7-r1
kube-mgmt-fips< 11.0.7-r1
kubescape< 4.0.8-r5
kubescape-operator< 0.2.142-r2
kubescape-operator-fips< 0.2.142-r2
kubescape-server< 4.0.8-r4
kubescape-server-downloader< 4.0.8-r4
kubescape-server-fips< 4.0.8-r6
kubescape-server-fips-downloader< 4.0.8-r6
kubevela-vela-cli< 1.10.8-r8
kubevela-vela-cli-fips< 1.10.8-r9
kubevela-vela-core< 1.10.8-r8
kubevela-vela-core-fips< 1.10.8-r9
linkerd2-cli< 26.5.3-r0
linkerd2-controller< 26.5.3-r0
linkerd2-fips-cli< 26.5.3-r1
linkerd2-fips-controller< 26.5.3-r1
linkerd2-fips-metrics-api< 26.5.3-r1
linkerd2-fips-tap< 26.5.3-r1
linkerd2-fips-web< 26.5.3-r1
linkerd2-metrics-api< 26.5.2-r1 | < 26.5.3-r0
linkerd2-tap< 26.5.3-r0
linkerd2-web< 26.5.3-r0
livekit-cli< 2.16.3-r3
manifest-tool< 2.2.2-r1
metricbeat-7All versions (No fix recorded)
metricbeat-fips-7All versions (No fix recorded)
neuvector-controller< 5.5.1-r6
neuvector-controller-fips< 5.5.1-r4
neuvector-enforcer< 5.5.1-r6

Show all 199

Alpine1 product

containerd≥ 1.7.27, < 2.3.1-r0

2 vendors · 200 products · Showing 200 of 364

References

9 links

github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4wX Refsource CONFIRMREPORTAdvisoryWEBMitigationVendor Advisory
ubuntu.com/security/CVE-2026-46680REPORT
www.cve.org/CVERecord?id=CVE-2026-46680REPORT
security-tracker.debian.org/tracker/CVE-2026-46680Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46680.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-46680AdvisoryOval
github.com/containerd/containerdPACKAGE
www.suse.com/security/cve/CVE-2026-46680WEB
security.alpinelinux.org/vuln/CVE-2026-46680Advisory