CVE-2026-53489

Description

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.

CVSS Metrics

• v4.0•HIGH•Score: 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
• v4.0•HIGH•Score: 8.2CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
• v4.0•HIGH•Score: 8.2CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
• v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 0.17%• Percentile: 7%

Techniques & Countermeasures

• CWE-61•UNIX Symbolic Link (Symlink) Following

  The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Affected Systems

• chainguard•amazon-ecs-agent

  < 1.105.0-r0

• chainguard•amazon-ecs-agent-fips

  < 1.105.0-r0

• chainguard•auditbeat-7

  < 7.17.29-r18

• chainguard•auditbeat-fips-7

  < 7.17.29-r20

• chainguard•buildctl

  < 0.31.0-r2

• chainguard•buildctl-fips

  < 0.31.0-r1

• chainguard•buildkitd

  < 0.31.0-r2

• chainguard•buildkitd-fips

  < 0.31.0-r1

• chainguard•cg

  < 0.2.295-r2

• chainguard•chainctl

  < 0.2.289-r1

• chainguard•chainctl-fips

  < 0.2.289-r1

• chainguard•chaos-mesh

  < 2.8.3-r3

• chainguard•chaos-mesh-daemon

  < 2.8.3-r3

• chainguard•chaos-mesh-dashboard

  < 2.8.3-r3

• chainguard•chaos-mesh-fips

  < 2.8.3-r2

• chainguard•chaos-mesh-fips-daemon

  < 2.8.3-r2

• chainguard•chaos-mesh-fips-dashboard

  < 2.8.3-r2

• chainguard•chartmuseum

  < 0.16.5-r15

• chainguard•chartmuseum-fips

  < 0.16.5-r15

• chainguard•cloudbeat-8.17

  < 8.17.10-r27

• chainguard•cloudbeat-8.19

  < 8.19.16-r2

• chainguard•cloudbeat-9.0

  < 9.0.8-r28

• chainguard•cloudbeat-9.1

  < 9.1.10-r20

• chainguard•cloudbeat-9.2

  < 9.2.8-r8

• chainguard•cloudbeat-9.3

  < 9.3.5-r2

• chainguard•cloudbeat-9.4

  < 9.4.2-r2

• chainguard•cloudbeat-fips-8.17

  < 8.17.10-r32

• chainguard•cloudbeat-fips-8.19

  < 8.19.16-r1

• chainguard•cloudbeat-fips-9.0

  < 9.0.8-r31

• chainguard•cloudbeat-fips-9.1

  < 9.1.10-r24

• chainguard•cloudbeat-fips-9.2

  < 9.2.8-r7

• chainguard•cloudbeat-fips-9.3

  < 9.3.5-r2

• chainguard•cloudbeat-fips-9.4

  < 9.4.2-r4

• chainguard•cluster-api-helm-controller

  < 0.6.4-r8

• chainguard•cluster-api-helm-controller-fips

  < 0.6.4-r7

• chainguard•commercial-gitlab-rails-ee-19.1

  all

• chainguard•commercial-gitlab-rails-ee-19.3

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.1

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.2

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.3

  all

• chainguard•consul-k8s-1.1-cli

  < 1.1.18-r40

• chainguard•consul-k8s-1.3-cli

  < 1.3.9-r47 | < 1.3.9-r46

• chainguard•consul-k8s-1.4-cli

  < 1.4.10-r32

• chainguard•consul-k8s-1.5-cli

  < 1.5.9-r30

• chainguard•consul-k8s-1.6-cli

  < 1.6.10-r24

• chainguard•consul-k8s-1.7-cli

  < 1.7.13-r14

• chainguard•consul-k8s-1.9-cli

  < 1.9.9-r0

• chainguard•consul-k8s-2.0-cli

  < 2.0.1-r1 | < 2.0.1-r2

• chainguard•consul-k8s-fips-1.1-cli

  < 1.1.18-r39 | < 1.1.18-r40

• chainguard•consul-k8s-fips-1.3-cli

  < 1.3.9-r43

Showing first 50 affected entries in server-rendered view.

References (5)

• https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388
• https://github.com/containerd/containerd
• https://security-tracker.debian.org/tracker/CVE-2026-53489
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53489.json
• https://nvd.nist.gov/vuln/detail/CVE-2026-53489