The vulnerability of the mechanism for processing container configuration tags in the CRI-plugin for Containerd allows a malicious actor to execute arbitrary commands.

🗓️ 25 Sep 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec🔗 bdu.fstec.ru👁 7 Views

Malicious actor can execute arbitrary commands via Containerd CRI-plugin tag processing.

Reporter	Title	Published	Views	Family All 956
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software	22 Sep 202613:26	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)	5 Aug 202613:18	–	ibm
attackerkb	CVE-2026-53488	1 Jul 202600:11	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-1897)	22 Jun 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : containerd, --advisory ALAS2DOCKER-2026-133 (ALASDOCKER-2026-133)	22 Jun 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : containerd, --advisory ALAS2ECS-2026-128 (ALASECS-2026-128)	30 Jun 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : containerd, --advisory ALAS2NITRO-ENCLAVES-2026-113 (ALASNITRO-ENCLAVES-2026-113)	30 Jun 202600:00	–	nessus
Tenable Nessus	Containerd 1.7.x < 1.7.33 / 2.0.x < 2.0.10 / 2.1.x < 2.1.9 / 2.2.x < 2.2.5 / 2.3.x < 2.3.2 Multiple Vulnerabilities	24 Jun 202600:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP12 : containerd (EulerOS-SA-2026-3396)	9 Sep 202600:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP12 : containerd (EulerOS-SA-2026-3397)	9 Sep 202600:00	–	nessus

Vulners

Node

OR

red_hat,red_hat_openshift_container_platformMatch4

red_hat,red_hat_ansible_automation_platformMatch2

red_hat,red_hat_advanced_cluster_securityMatch4

red_hat,red_hat_ceph_storageMatch6

red_hat,assisted_installer_for_red_hat_openshift_container_platformMatch2

red_hat,red_hat_ceph_storageMatch9

red_hat,openshift_api_for_data_protectionMatch1.3

red_hat,red_hat_trusted_artifact_signerMatch1.4

red_hat,multicluster_engine_for_kubernetesMatch2.6

red_hat,multicluster_global_hubMatch1.4.5

red_hat,red_hat_advanced_cluster_management_for_kubernetesMatch2.13

red_hat,red_hat_advanced_cluster_securityMatch4.9

red_hat,red_hat_advanced_cluster_management_for_kubernetesMatch2.14

red_hat,red_hat_openshift_dataMatch4.19

red_hat,red_hat_openshift_dataMatch4.2

cloud_native_computing containerdRange1.7.0–1.7.33

cloud_native_computing containerdRange2.0.0–2.0.10

cloud_native_computing containerdRange2.1.0–2.1.9

cloud_native_computing containerdRange2.2.0–2.2.5

cloud_native_computing containerdRange2.3.0–2.3.2

red_hat,multicluster_engine_for_kubernetesMatch2.1

red_hat,multicluster_global_hubMatch1.6.5

red_hat,multicluster_global_hubMatch1.7.0

red_hat,openshift_api_for_data_protectionMatch1.4

red_hat,red_hat_advanced_cluster_management_for_kubernetesMatch2.11

red_hat,red_hat_advanced_cluster_management_for_kubernetesMatch2.15

red_hat,red_hat_advanced_cluster_management_for_kubernetesMatch2.16

red_hat,red_hat_advanced_cluster_management_for_kubernetesMatch2.17

red_hat,red_hat_openshift_dev_spacesMatch3.30

canonical ubuntuMatch25.10

Source	Link
github	www.github.com/containerd/containerd
github	www.github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
repo	www.repo.red-soft.ru/redos/8.0/x86_64/updates/
security-tracker	www.security-tracker.debian.org/tracker/CVE-2026-53488
deb	www.deb.freexian.com/extended-lts/tracker/CVE-2026-53488
access	www.access.redhat.com/security/cve/CVE-2026-53488
ubuntu	www.ubuntu.com/security/CVE-2026-53488
web	www.web.nvd.nist.gov/view/vuln/detail

25 Sep 2026 00:00Current

8.6High risk

Vulners AI Score8.6

CVSS 27.2

CVSS 39.3

EPSS0.00163

Containerd CRI-plugin arbitrary commands input validation