CVE-2021-43816

CVE-2021-43816 affects containerd (CRI) on SELinux-enabled distros (EL8/CentOS/RHEL, Fedora, SUSE MicroOS). An unprivileged pod could bind-mount a privileged host file via hostPath at /etc/hosts, /etc/hostname, or /etc/resolv.conf, relabeling that path to the container process label and potential...

CVE-2025-47290

CVE-2025-47290 affects containerd v2.1.0, where a TOCTOU flaw during image unpack could allow an attacker to arbitrarily modify the host filesystem. The issue is limited to 2.1.0; 2.1.1 fixes it. Affected guidance: upgrade to containerd 2.1.1+; as a workaround, use only trusted images and restric...

CVE-2026-53488

CVE-2026-53488 affects containerd’s CRI plugin: image config LABELs are propagated to containers without validation, enabling potential host-command execution via a plugin that consumes labels. Concrete details across connected docs confirm this vulnerability in containerd versions prior to 1.7.3...

CVE-2026-50195

Containerd CVE-2026-50195 affects CRI checkpoint import: unvalidated image references in a checkpoint config allow an attacker with pod-creation permissions to trigger pulling a malicious image and assign it a local tag, poisoning the node’s local image cache. Subsequent pods on the same node usi...

CVE-2026-53492

Summary: CVE-2026-53492 affects containerd’s CRI checkpoint restoration, where CDI annotations in untrusted checkpoint metadata are trusted, allowing injection of CDI edits (device nodes/host mounts) into restored containers if CDI is enabled and a matching host CDI spec exists. The issue affects...