CVE-2026-53488: containerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull

Analyzed

AliasesUBUNTU-CVE-2026-53488DEBIAN-CVE-2026-53488CGA-23rf-3686-9vgj+609 more

Published 01-07-2026Last modified 03-07-2026

Vulnerability summary

CVE-2026-53488 is a critical (CVSS 9.4) Improper Input Validation vulnerability in containerd. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.1% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 9.4 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

9.4/10

010

Critical · v4.0 (CVE.org)

EPSS score

0.18%

0%100%

Low · +0.01 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 11

OPENSUSE-SU-2026:11102-1 OPENSUSE-SU-2026:11107-1 OPENSUSE-SU-2026:21072-1 OPENSUSE-SU-2026:21213-1 OPENSUSE-SU-2026:21483-1 RHSA-2026:35111+6 more

Timeline

01-07-2026
PublishedVulnerability first disclosed.
03-07-2026
Last modifiedVulnerability information updated.

Description

containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.

CVSS metrics

10 scores · 8 sources · 2 versions

v4.09.4v3.18.8

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

Versus all other CVEs

30-day change

Increase +0.01 pp

From 0.16% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Version check

Known conditions: local access, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

amazon-ecs-agent< 1.104.0-r2
amazon-ecs-agent-fips< 1.104.0-r2
auditbeat-7All versions (No fix recorded)
auditbeat-fips-7All versions (No fix recorded)
buildctl< 0.31.0-r2

buildctl-fips< 0.31.0-r1
buildkitd< 0.31.0-r2
buildkitd-fips< 0.31.0-r1
cg< 0.2.295-r2
chainctl< 0.2.289-r1
chainctl-fips< 0.2.289-r1
chaos-mesh< 2.8.3-r1
chaos-mesh-daemon< 2.8.3-r1
chaos-mesh-dashboard< 2.8.3-r1
chaos-mesh-fips< 2.8.3-r1
chaos-mesh-fips-daemon< 2.8.3-r1
chaos-mesh-fips-dashboard< 2.8.3-r1
chartmuseum< 0.16.5-r13
chartmuseum-fips< 0.16.5-r11
cloudbeat-8.17< 8.17.10-r26
cloudbeat-8.19< 8.19.16-r3 | < 8.19.16-r2
cloudbeat-9.0< 9.0.8-r29 | < 9.0.8-r28
cloudbeat-9.1< 9.1.10-r21 | < 9.1.10-r20
cloudbeat-9.2< 9.2.8-r8 | < 9.2.8-r9
cloudbeat-9.3< 9.3.5-r3 | < 9.3.5-r2
cloudbeat-9.4< 9.4.2-r2 | < 9.4.2-r3
cloudbeat-fips-8.17< 8.17.10-r31
cloudbeat-fips-8.19< 8.19.16-r1 | < 8.19.16-r2
cloudbeat-fips-9.0< 9.0.8-r31 | < 9.0.8-r32
cloudbeat-fips-9.1< 9.1.10-r24 | < 9.1.10-r25
cloudbeat-fips-9.2< 9.2.8-r7 | < 9.2.8-r8
cloudbeat-fips-9.3< 9.3.5-r3 | < 9.3.5-r2
cloudbeat-fips-9.4< 9.4.2-r4 | < 9.4.2-r5
cluster-api-helm-controller< 0.6.4-r7
cluster-api-helm-controller-fips< 0.6.4-r7
consul-k8s-1.1-cli< 1.1.18-r40
consul-k8s-1.3-cli< 1.3.9-r45
consul-k8s-1.4-cli< 1.4.10-r31
consul-k8s-1.5-cli< 1.5.9-r29
consul-k8s-1.6-cli< 1.6.10-r24
consul-k8s-1.7-cli< 1.7.13-r14
consul-k8s-1.9-cli< 1.9.8-r5
consul-k8s-2.0-cli< 2.0.0-r2
consul-k8s-fips-1.1-cli< 1.1.18-r39
consul-k8s-fips-1.3-cli< 1.3.9-r41
consul-k8s-fips-1.4-cli< 1.4.10-r31
consul-k8s-fips-1.5-cli< 1.5.9-r32
consul-k8s-fips-1.6-cli< 1.6.10-r25
consul-k8s-fips-1.7-cli< 1.7.13-r16
consul-k8s-fips-1.9-cli< 1.9.8-r4
consul-k8s-fips-2.0-cli< 2.0.0-r3
crossplane-2.3-crank< 2.3.3-r0
crossplane-fips-2.3-crank< 2.3.3-r0
ctop< 0.7.7-r37
dagger< 0.20.8-r9
datadog-agent-7.71< 7.71.2-r29
datadog-agent-7.72< 7.72.4-r31
datadog-agent-7.73< 7.73.3-r23
datadog-agent-7.74< 7.74.1-r21
datadog-agent-7.75All versions (No fix recorded)
datadog-agent-7.76< 7.76.3-r41 | All versions (No fix recorded) | < 7.76.3-r28
datadog-agent-7.77< 7.77.3-r17
datadog-agent-7.78< 7.78.4-r12
datadog-agent-7.79< 7.79.2-r5
datadog-agent-7.80< 7.80.4-r1
datadog-agent-fips-7.71< 7.71.2-r21
datadog-agent-fips-7.72< 7.72.4-r28
datadog-agent-fips-7.73< 7.73.3-r23
datadog-agent-fips-7.74< 7.74.1-r21
datadog-agent-fips-7.75All versions (No fix recorded)
datadog-agent-fips-7.76< 7.76.3-r26
datadog-agent-fips-7.77< 7.77.3-r18
datadog-agent-fips-7.78< 7.78.4-r9
datadog-agent-fips-7.79< 7.79.2-r4
datadog-agent-fips-7.80< 7.80.4-r2
docker-cli-buildx< 0.35.0-r1
docker-cli-buildx-fips< 0.35.0-r1
docker-compose< 5.1.4-r6
docker-compose-fips< 5.1.4-r5
dockerd-28All versions (No fix recorded)
dockerd-29< 29.6.0-r1
dockerd-fips-28All versions (No fix recorded)
dockerd-fips-29< 29.5.2-r4
dogstatsd-7.71< 7.71.2-r29
dogstatsd-7.72< 7.72.4-r31
dogstatsd-7.73< 7.73.3-r23
dogstatsd-7.74< 7.74.1-r21
dogstatsd-7.75All versions (No fix recorded)
dogstatsd-7.76< 7.76.3-r28
dogstatsd-7.77< 7.77.3-r17
dogstatsd-7.78< 7.78.4-r12
dogstatsd-7.79< 7.79.2-r5
dogstatsd-7.80< 7.80.4-r1
eksctl< 0.227.0-r5
envoy-gateway-1.5-egctl< 1.5.9-r2
envoy-gateway-1.6-egctl< 1.6.7-r2
envoy-gateway-1.7-egctl< 1.7.4-r2
envoy-gateway-1.8-egctl< 1.8.2-r2
envoy-gateway-egctl< 1.8.1-r2
envoy-gateway-fips-1.5-egctl< 1.5.9-r2
envoy-gateway-fips-1.6-egctl< 1.6.7-r2
envoy-gateway-fips-1.7-egctl< 1.7.4-r2
envoy-gateway-fips-1.8-egctl< 1.8.2-r2
envoy-gateway-fips-egctl< 1.8.1-r1
falco-no-driver< 0.45.0-r0
filebeat-7All versions (No fix recorded)
filebeat-fips-7All versions (No fix recorded)
filebeat-oss-7All versions (No fix recorded)
filebeat-oss-fips-7All versions (No fix recorded)
fuse-overlayfs-snapshotter< 2.1.7-r17
gatekeeper-3.20-gatorAll versions (No fix recorded)
gatekeeper-3.21-gator< 3.21.1-r13
gitlab-rails-ce-18.1All versions (No fix recorded)
gitlab-rails-ce-18.10All versions (No fix recorded)
gitlab-rails-ce-18.11< 18.11.6-r7
gitlab-rails-ce-18.5All versions (No fix recorded)
gitlab-rails-ce-18.6All versions (No fix recorded)
gitlab-rails-ce-18.7All versions (No fix recorded)
gitlab-rails-ce-18.8All versions (No fix recorded)
gitlab-rails-ce-18.9All versions (No fix recorded)
gitlab-rails-ce-19.0< 19.0.4-r6
gitlab-rails-ce-19.1< 19.1.2-r3
gitlab-rails-ce-fips-18.1All versions (No fix recorded)
gitlab-rails-ce-fips-18.10All versions (No fix recorded)
gitlab-rails-ce-fips-18.11< 18.11.6-r6
gitlab-rails-ce-fips-18.5All versions (No fix recorded)
gitlab-rails-ce-fips-18.6All versions (No fix recorded)
gitlab-rails-ce-fips-18.7All versions (No fix recorded)
gitlab-rails-ce-fips-18.8All versions (No fix recorded)
gitlab-rails-ce-fips-18.9All versions (No fix recorded)
gitlab-rails-ce-fips-19.0< 19.0.4-r4
gitlab-rails-ce-fips-19.1< 19.1.2-r2
google-osconfig-agent< 20251028.00-r23
grype< 0.114.0-r1
grype-db< 0.54.0-r1
grype-fips< 0.114.0-r1
harvester< 1.8.1-r0
harvester-fips< 1.8.1-r0
harvester-fips-webhook< 1.8.1-r0
harvester-webhook< 1.8.1-r0
headlamp< 0.43.0-r1
headlamp-fips< 0.43.0-r2
heartbeat-7All versions (No fix recorded)
heartbeat-fips-7All versions (No fix recorded)
helm-3< 3.21.2-r1 | < 3.22.0-r0
helm-exporter< 1.3.0-r11
helm-exporter-fips< 1.3.0-r12
helm-fips-3< 3.21.2-r1
helm-mapkubeapis< 0.6.1-r21
helm-operator< 1.42.2-r13
helm-operator-fips< 1.42.2-r6
helm-push< 0.11.1-r16
helm-set-status< 0.3.0-r20
helmfile< 1.5.5-r1
jfrog-cli< 2.109.0-r1
k3s-1.31All versions (No fix recorded)
k3s-fips-1.33All versions (No fix recorded)
k3s-static< 1.36.2.1-r1
k3s-static-1.31All versions (No fix recorded)
k3s-static-1.34< 1.34.9.1-r1
k3s-static-1.35< 1.35.6.1-r1
k8sgpt< 0.4.38-r3 | < 0.4.34-r1 | All versions (No fix recorded)
k8ssandra-client< 0.9.1-r2
k9s< 0.51.0-r1 | < 0.51.0-r2
k9s-fips< 0.51.0-r1 | < 0.51.0-r2
kaniko< 1.25.15-r10 | < 1.25.15-r9
kaniko-fips< 1.25.15-r8 | < 1.25.15-r7
kaniko-warmer< 1.25.15-r9 | < 1.25.15-r10
kaniko-warmer-fips< 1.25.15-r8 | < 1.25.15-r7
kargo< 1.10.7-r1
kgateway-2.3< 2.3.4-r1
kgateway-2.4< 2.4.2-r1
kgateway-fips-2.3< 2.3.4-r1
kgateway-fips-2.4< 2.4.2-r2
kots< 1.130.4-r8
kube-arangodb-1.3All versions (No fix recorded)
kube-arangodb-1.4< 1.4.3-r11
kube-arangodb-fips-1.3All versions (No fix recorded)
kube-arangodb-fips-1.4< 1.4.3-r6
kube-mgmt< 11.0.7-r4
kube-mgmt-fips< 11.0.7-r6
kubescape< 4.0.9-r1
kubescape-operator< 0.2.151-r1 | < 0.2.172-r2
kubescape-operator-fips< 0.2.151-r1
kubescape-server< 4.0.9-r2
kubescape-server-downloader< 4.0.9-r2
kubescape-server-fips< 4.0.9-r2
kubescape-server-fips-downloader< 4.0.9-r2
kubevela-vela-cli< 1.10.8-r11
kubevela-vela-cli-fips< 1.10.8-r12
kubevela-vela-core< 1.10.8-r11
kubevela-vela-core-fips< 1.10.8-r12
linkerd2-cli< 26.6.3-r2
linkerd2-controller< 26.6.3-r2
linkerd2-controller-compat< 26.9.2-r0
linkerd2-debug< 26.9.2-r0
linkerd2-fips-cli< 26.6.3-r1
linkerd2-fips-controller< 26.6.3-r1
linkerd2-fips-metrics-api< 26.6.3-r1

Show all 199

Alpine1 product

containerd≥ 1.7.0, < 2.3.2-r0

2 vendors · 200 products · Showing 200 of 384

References

15 links

github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxpX Refsource CONFIRMREPORTAdvisoryWEBMitigationVendor Advisory
ubuntu.com/security/CVE-2026-53488REPORT
www.cve.org/CVERecord?id=CVE-2026-53488REPORT
ubuntu.com/security/notices/USN-8471-1Advisory
ubuntu.com/security/notices/USN-8472-1Advisory
ubuntu.com/security/notices/USN-8473-1Advisory
security-tracker.debian.org/tracker/CVE-2026-53488Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53488.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-53488AdvisoryOval
github.com/containerd/containerdPACKAGE

Show all 15 references