CVE-2026-53489
ADVISORY - githubSummary
Impact
A bug was found in containerd where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs.
Patches
This bug has been fixed in the following containerd versions:
- 2.3.2
- 2.2.5
- 2.1.9
Users should update to these versions to resolve the issue.
Workarounds
Ensure that only trusted images and checkpoints are used.
Credits
The containerd project would like to thank @gouldnicholas and @davidrxchester, Yuming Zhang and Song Li of Zhejiang University, Sangwon Ryu (@sangwon090), Henry Beberman (@hbeberman) of Microsoft, the GKE Security Team using Gemini, Anthropic Research, in collaboration with Claude, Robert Prast (@robertprast), Kyle Elliott (@kyle-elliott-tob) of Trail of Bits, and Zhenchen Wang (@Plucky923), who independently discovered and responsibly disclosed this issue in accordance with the containerd security policy.
For more information
If you have any questions or comments about this advisory:
- Open an issue in containerd
- Email us at security@containerd.io
To report a security issue in containerd:
- Report a new vulnerability
- Email us at security@containerd.io
Common Weakness Enumeration (CWE)
UNIX Symbolic Link (Symlink) Following
Improper Link Resolution Before File Access ('Link Following')
GitHub
-
CVSS SCORE
7.1highAlpine
-
Debian
-
CVSS SCORE
N/AlowUbuntu
2.0
CVSS SCORE
6.5highGoLang
-
Amazon
-
CVSS SCORE
N/AhighRed Hat
2.0
CVSS SCORE
6.5highChainguard
CGA-m8q9-38p9-c4g7
-
minimos
MINI-25h7-2p24-grxc
-
minimos
MINI-263x-7pq9-jv7g
-
minimos
MINI-2h34-wfp4-vcw4
-
minimos
MINI-2j2q-j9jh-5f46
-
minimos
MINI-3825-g7q9-g9h2
-
minimos
MINI-3mjf-qvw3-367f
-
minimos
MINI-3wpq-gc3r-qfg7
-
minimos
MINI-43w3-c933-f2g5
-
minimos
MINI-4648-hx62-gjjv
-
minimos
MINI-46xq-chgg-9ccj
-
minimos
MINI-4jjx-8jhf-ghx6
-
minimos
MINI-4xjg-3v99-h5w3
-
minimos
MINI-52vg-8h8f-hr6c
-
minimos
MINI-546r-h4gv-47hc
-
minimos
MINI-5485-9cm2-6jh2
-
minimos
MINI-5cpq-6x4r-m68v
-
minimos
MINI-5h2g-ccqm-x39v
-
minimos
MINI-5rf7-jpg3-vpj7
-
minimos
MINI-5v2m-cx2c-5xr5
-
minimos
MINI-5vc9-hfq5-x4xm
-
minimos
MINI-64qm-44vm-rwqm
-
minimos
MINI-6863-rwq8-rm3q
-
minimos
MINI-69jr-cqj5-p4j2
-
minimos
MINI-6h3w-5mc8-wphm
-
minimos
MINI-6mjj-fgrx-7qgh
-
minimos
MINI-6qm2-cm9g-cvc2
-
minimos
MINI-6w29-9265-53q5
-
minimos
MINI-77p4-h8cx-6534
-
minimos
MINI-785q-789h-r4x8
-
minimos
MINI-7j9p-2qc8-6cwx
-
minimos
MINI-7p33-jqjm-q83v
-
minimos
MINI-87rf-g3jx-2mpv
-
minimos
MINI-8chx-hqcg-wchr
-
minimos
MINI-8pj6-prrc-c93m
-
minimos
MINI-93f4-cgfc-7q9v
-
minimos
MINI-93p4-5525-x5xw
-
minimos
MINI-9r93-422g-wgp8
-
minimos
MINI-cmvq-3v5c-672v
-
minimos
MINI-cqmq-3cg2-ffxx
-
minimos
MINI-crh4-83w8-v6rx
-
minimos
MINI-cvj2-73rw-chf9
-
minimos
MINI-f24j-979f-87m9
-
minimos
MINI-fc9x-9qmp-4mjj
-
minimos
MINI-fmm3-5ghq-h926
-
minimos
MINI-fqg7-f43r-v995
-
minimos
MINI-g4j4-v4fp-m35m
-
minimos
MINI-g99f-6m43-9jmj
-
minimos
MINI-ggrm-5mw8-489p
-
minimos
MINI-gjr3-2mvp-252r
-
minimos
MINI-gp9x-77qm-47q4
-
minimos
MINI-gv5p-4296-6xrm
-
minimos
MINI-h2v3-qmg4-4xcj
-
minimos
MINI-h35p-qrx6-c23m
-
minimos
MINI-h45w-6mr3-3gxq
-
minimos
MINI-hhjv-4r3r-rf6f
-
minimos
MINI-hx3w-qxj7-g4vp
-
minimos
MINI-j99g-x3m2-h385
-
minimos
MINI-jcrj-m2jr-6px9
-
minimos
MINI-jf4m-f88m-6xpm
-
minimos
MINI-jg6r-xwxr-wcrq
-
minimos
MINI-jh5h-qfhw-qr6c
-
minimos
MINI-jr33-3j67-h8pr
-
minimos
MINI-jv29-wjj6-f8m4
-
minimos
MINI-jvwg-3g7m-7v2c
-
minimos
MINI-jx2v-mpf3-p4g4
-
minimos
MINI-m22j-hgpw-gr92
-
minimos
MINI-m5wj-v6mh-38h3
-
minimos
MINI-mc49-4m86-mmpp
-
minimos
MINI-mg23-ff75-554p
-
minimos
MINI-mmhf-7px2-3hcf
-
minimos
MINI-mmrg-wg9x-fqx3
-
minimos
MINI-p7p8-98qq-5hch
-
minimos
MINI-pfjh-34gr-g6jx
-
minimos
MINI-pfvh-cfj5-69x5
-
minimos
MINI-pgr4-4f5h-w5mf
-
minimos
MINI-pmxx-9g6m-87mg
-
minimos
MINI-q4p9-4c98-87f8
-
minimos
MINI-qm6q-hrwg-gwh3
-
minimos
MINI-qm7g-xf76-9743
-
minimos
MINI-qrg7-pgwg-qrcw
-
minimos
MINI-qv9h-2gx5-9xqh
-
minimos
MINI-r5j2-qxrh-wfxj
-
minimos
MINI-rf5m-9g58-v4xq
-
minimos
MINI-rjh4-f9hp-wm4j
-
minimos
MINI-rjvf-gwj3-88x5
-
minimos
MINI-rw29-gh9g-x6vm
-
minimos
MINI-v5jg-8h8v-vwh5
-
minimos
MINI-vfx7-2r34-vhfm
-
minimos
MINI-vgf4-33rm-44jh
-
minimos
MINI-vgr3-3h37-c63m
-
minimos
MINI-vj6g-9wr8-mc32
-
minimos
MINI-vwxp-7p5f-92c3
-
minimos
MINI-wfv6-8wc8-fvm9
-
minimos
MINI-wxqh-wcgm-v69r
-
minimos
MINI-x29f-9757-h92g
-
minimos
MINI-x367-qc43-4r84
-
minimos
MINI-x579-3hgc-8fx5
-
minimos
MINI-x645-jr55-xwvf
-
minimos
MINI-x8h6-g3f8-p6vq
-
minimos
MINI-xfff-jpcm-69wm
-
minimos
MINI-xfvm-v8h8-v632
-
minimos
MINI-xfxw-pqr7-2q5h
-
minimos
MINI-xgfv-9w23-w6f5
-
minimos
MINI-xh28-g2mv-7q7v
-