Skip to content
Fencer Vulns
medium 6.5

CVE-2026-53489 json

containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore

published 2026-06-19 4 mo ago modified 2026-09-10 1 mo ago also GHSA-rgh6-rfwx-v388 , GO-2026-5622 , EUVD-2026-41110

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 6%
public exploits
0
none known

Summary

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.

Patch / fix

  • go github.com/containerd/containerd/v2 2.1.9, 2.2.5, 2.3.2
  • linuxfoundation containerd 2.1.9, 2.2.5, 2.3.2
  • containerd Debian 14 2.1.9+ds1-1

debian advisories DEBIAN-CVE-2026-53489

  • containerd-app Ubuntu 22.04 LTS 2.2.1-0ubuntu1~22.04.2
  • containerd-app Ubuntu 24.04 LTS 2.2.1-0ubuntu1~24.04.3
  • containerd-app Ubuntu 25.10 2.2.1-0ubuntu1~25.10.2
  • containerd-app Ubuntu 26.04 LTS 2.2.2-0ubuntu1.1
  • containerd-stable Ubuntu 25.10 2.1.6-0ubuntu1~25.10.2
  • containerd-stable Ubuntu 26.04 LTS 2.2.2-0ubuntu1.1

ubuntu advisories UBUNTU-CVE-2026-53489

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • syft hummingbird 1 1.46.0-0.1.hum1
  • grype hummingbird 1 0.115.0-0.1.hum1
  • trivy hummingbird 1 0.69.3-1.2.hum1

red hat advisories RHSA-2026:32974RHSA-2026:32963RHSA-2026:15862

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
  • trivy openSUSE Leap 16.0 0.71.2-160000.1.1
  • trivy openSUSE Tumbleweed 0.71.2-1.1

opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2026:21072-1openSUSE-SU-2026:11102-1

  • containerd Alpine 3.24 2.3.2-r0

alpine advisories ALPINE-CVE-2026-53489

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • containerd2 Azure Linux 3.0 2.2.4-3

azure linux advisories AZL-90173

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-53489 updated cvss 6.5

github.com/containerd/containerd: containerd: Arbitrary host file read via symlink following in CRI checkpoint restore

  • Red Hat Exploit Intelligence exploit-intelligence-tech-preview/agent-client-rhel9 Red Hat MCP Server for Red Hat OpenShift openshift-mcp-beta/openshift-mcp-server-rhel9 Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-api-rhel9, mtv-candidate/mtv-rhel9-operator, mtv-candidate/mtv-virt-v2v-rhel9, mtv-candidate/mtv-operator-bundle, mtv-candidate/mtv-controller-rhel9, mtv-candidate/mtv-cli-download-rhel9, +5 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Serverless openshift-serverless-1/serverless-must-gather-rhel9
    affected: workaround, no fix available
  • Red Hat Ceph Storage 6 rhceph/rhceph-promtail-rhel9 Red Hat Ceph Storage 9 rhceph/alloy-rhel10
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images syft 1.46.0-0.1.hum1, trivy 0.69.3-1.2.hum1, grype 0.115.0-0.1.hum1
    fixed: vendor fix RHSA-2026:32963
  • Red Hat Openshift Data Foundation 4.19 odf4/cephcsi-rhel9 1786701839, odf4/odf-cli-rhel9 1786702440, odf4/mcg-core-rhel9 1786702052, odf4/odf-console-rhel9 1786703071, odf4/mcg-rhel9-operator 1786702559, odf4/ocs-rhel9-operator 1786702276, +14 more
    fixed: vendor fix RHSA-2026:56366
  • Red Hat Openshift Data Foundation 4.20 odf4/cephcsi-rhel9 1786627460, odf4/odf-cli-rhel9 1786628142, odf4/mcg-core-rhel9 1786628235, odf4/odf-console-rhel9 1786628053, odf4/mcg-rhel9-operator 1786627106, odf4/ocs-rhel9-operator 1786629478, +16 more
    fixed: vendor fix RHSA-2026:57013
  • Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 rhai/assisted-installer-agent-rhel9, assisted/agent-preinstall-image-builder-rhel9 Red Hat Confidential Compute Attestation openshift-sandboxed-containers/osc-monitor-rhel9, openshift-sandboxed-containers/osc-must-gather-rhel9, openshift-sandboxed-containers/osc-podvm-payload-rhel9, openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9 Red Hat Deployment Validation Operator dvo/deployment-validation-rhel8-operator Red Hat Gatekeeper 3 gatekeeper/gatekeeper-rhel9 Red Hat Kernel Module Management Operator for Red Hat Openshift kmm/kernel-module-management-must-gather-rhel9 Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-loki-rhel9, openshift-logging/cluster-logging-rhel9-operator
    +25 more products
    Red Hat Logical Volume Manager Storage lvms4/lvms-must-gather-rhel9 Red Hat Machine Deletion Remediation Operator workload-availability/machine-deletion-remediation-rhel9-operator, workload-availability/machine-deletion-remediation-operator-bundle Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-log-reader-rhel8, rhmtc/openshift-migration-must-gather-rhel8 Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-validation-rhel9, mtv-candidate/mtv-must-gather-rhel8, migration-toolkit-virtualization/mtv-validation-rhel9, migration-toolkit-virtualization/mtv-must-gather-rhel8, migration-toolkit-virtualization/mtv-must-gather-rhel9 Red Hat Multicluster Engine for Kubernetes multicluster-engine/must-gather-rhel9, multicluster-engine/assisted-installer-rhel8, multicluster-engine/assisted-service-8-rhel8, multicluster-engine/assisted-service-9-rhel9, multicluster-engine/assisted-installer-agent-rhel8, multicluster-engine/assisted-installer-agent-rhel9, +2 more Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-agent-rhel9, multicluster-globalhub/multicluster-globalhub-grafana-rhel9, multicluster-globalhub/multicluster-globalhub-manager-rhel9, multicluster-globalhub/multicluster-globalhub-rhel9-operator Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift API for Data Protection oadp/oadp-mustgather-rhel9 Red Hat OpenShift Developer Tools and Services ocp-tools-4/jenkins-rhel8, ocp-tools-4/jenkins-rhel9, ocp-tools-4/jenkins-agent-base-rhel8, ocp-tools-4/jenkins-agent-base-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/openshift-mcp-server-rhel9, openshift-lightspeed/lightspeed-agentic-sandbox-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-controller-rhel8, openshift-pipelines/pipelines-entrypoint-rhel8, openshift-pipelines/pipelines-results-watcher-rhel8, openshift-pipelines/pipelines-sidecarlogresults-rhel8 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/istio-rhel8-operator, openshift-service-mesh/istio-must-gather-rhel9 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/istio-rhel9-operator, openshift-service-mesh/istio-must-gather-rhel9 Red Hat Pen Drive Powered by Red Hat Lightspeed pen-drive/pen-drive-scanner-rhel9 Red Hat Power monitoring for Red Hat OpenShift openshift-power-monitoring/power-monitoring-rhel9-operator Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/acm-grafana-rhel9, rhacm2/acm-must-gather-rhel9, rhacm2/multiclusterhub-rhel9, rhacm2/submariner-rhel9-operator, rhacm2/submariner-operator-bundle, rhacm2/multicloud-integrations-rhel9, +2 more Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-main-rhel9, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-roxctl-rhel9, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-rhel9-operator, +3 more Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/aap-must-gather-rhel8, ansible-automation-platform-25/aap-must-gather-rhel8, ansible-automation-platform-26/aap-must-gather-rhel9, ansible-automation-platform-27/aap-must-gather-rhel9 Red Hat Build of Kueue kueue/kueue-must-gather-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/rhai-cli-rhel9, rhoai/odh-must-gather-rhel9, rhoai/odh-spark-operator-rhel9, rhoai/odh-th06-cpu-torch291-py312-rhel9, rhoai/odh-th06-cuda130-torch291-py312-rhel9, rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9, +17 more Red Hat OpenShift Container Platform 4 openshift4/ose-cli, openshift4/ose-tests, openshift4/ose-console, openshift-kni/commatrix, openshift4/ose-deployer, openshift4/ose-cli-rhel9, +71 more Red Hat OpenShift Container Platform 5 openshift-kni/commatrix, openshift5/cnf-tests-rhel9, openshift5/ose-console-rhel9, openshift5/metallb-rhel9-operator, openshift5/oc-mirror-plugin-rhel9, openshift5/ose-olm-catalogd-rhel9, +15 more Red Hat Openshift Data Foundation 4.19 odf4/mcg-operator-bundle 1786705806, odf4/ocs-operator-bundle 1786706032, odf4/odf-operator-bundle 1786706375, odf4/cephcsi-operator-bundle 1786705694, odf4/odr-hub-operator-bundle 1786706461, odf4/rook-ceph-operator-bundle 1786706507, +7 more Red Hat Openshift Data Foundation 4.20 odf4/mcg-operator-bundle 1786689758, odf4/ocs-operator-bundle 1786689936, odf4/odf-operator-bundle 1786690288, odf4/cephcsi-operator-bundle 1786689641, odf4/odr-hub-operator-bundle 1786690447, odf4/rook-ceph-operator-bundle 1786690533, +8 more Red Hat OpenShift Dev Spaces devspaces/traefik-rhel9
    not affected: vulnerable code not present

8 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.17% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.2 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CNA 4.0 8.2 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/containerd/containerd/v2
>=2.1.0, <2.1.9
>=2.2.0, <2.2.5
>=2.3.0, <2.3.2
2.1.9
2.2.5
2.3.2
go github.com/containerd/containerd
all versions
 no fix listed

Affected products

  • containerd containerd

Classification

Weakness
  • CWE-61 UNIX Symbolic Link (Symlink) Following

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.