CVE-2026-50195

Analyzed Analyzed - Analysis Complete

Container Image Cache Poisoning in containerd

Publication date: 2026-07-01

Last updated on: 2026-07-02

Assigner: GitHub, Inc.

Description

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can use a crafted checkpoint image to force containerd to pull a malicious image and assign it an arbitrary local tag, thereby poisoning the node's local image cache. Subsequently, if other pods on the same node attempt to use the poisoned tag with an IfNotPresent (or Never) pull policy, they will unknowingly execute the attacker's malicious image instead of the legitimate one. This can lead to a compromise of the affected pods, allowing the attacker to execute arbitrary code under the victim pod's identity. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-01

Last Modified

2026-07-02

Generated

2026-07-22

AI Q&A

2026-07-01

EPSS Evaluated

2026-07-20

NVD

CVE-2026-50195

EUVD

EUVD-2026-41108

Affected Vendors & Products

Vendor	Product	Version / Range
linuxfoundation	containerd	From 2.1.0 (inc) to 2.1.9 (exc)
linuxfoundation	containerd	From 2.2.0 (inc) to 2.2.5 (exc)
linuxfoundation	containerd	From 2.3.0 (inc) to 2.3.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-829	The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

CVE-2026-50195 is a vulnerability in containerd's CRI checkpoint import process where it fails to validate image references within a checkpoint image's configuration.

An attacker with permissions to create pods can craft a malicious checkpoint image that forces containerd to pull a harmful image and assign it an arbitrary local tag, poisoning the node's local image cache.

If other pods on the same node use the poisoned tag with an IfNotPresent or Never pull policy, they will unknowingly execute the attacker's malicious image instead of the legitimate one.

This can lead to compromise of affected pods, allowing the attacker to execute arbitrary code under the victim pod's identity.

Detection Guidance

There is no specific detection method or commands provided in the available information to identify this vulnerability on your network or system.

However, you can check the version of containerd installed on your system to determine if it is vulnerable. Versions prior to 2.3.2, 2.2.5, and 2.1.9 are affected.

A common command to check the containerd version is:

containerd --version

If your version is vulnerable, updating to a patched version is recommended.

Impact Analysis

This vulnerability can lead to the compromise of pods running on the affected node.

An attacker can execute arbitrary code within victim pods by poisoning the local image cache with malicious images.

This can result in unauthorized actions being performed under the identity of the compromised pods, potentially leading to data breaches, service disruption, or further system compromise.

Compliance Impact

The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, you should update containerd to one of the patched versions: 2.1.9, 2.2.5, or 2.3.2.

As a workaround until you can update, ensure that only trusted images are allowed to be pulled to prevent the use of malicious checkpoint images.

Hi! I’m here to help you understand CVE-2026-50195. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70