CVE-2026-53488

Analyzed Analyzed - Analysis Complete

Command Injection in Containerd via Unvalidated Image Labels

Publication date: 2026-07-01

Last updated on: 2026-07-03

Assigner: GitHub, Inc.

Description

containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-01

Last Modified

2026-07-03

Generated

2026-07-21

AI Q&A

2026-07-01

EPSS Evaluated

2026-07-19

NVD

CVE-2026-53488

EUVD

EUVD-2026-40860

Affected Vendors & Products

Vendor	Product	Version / Range
linuxfoundation	containerd	From 2.1.0 (inc) to 2.1.9 (exc)
linuxfoundation	containerd	From 2.2.0 (inc) to 2.2.5 (exc)
linuxfoundation	containerd	From 2.3.0 (inc) to 2.3.2 (exc)
linuxfoundation	containerd	From 1.7.0 (inc) to 1.7.33 (exc)
linuxfoundation	containerd	From 2.0.0 (inc) to 2.0.10 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

CVE-2026-53488 is a critical vulnerability in containerd, an open-source container runtime. The issue occurs because the CRI plugin propagates labels from an image configuration (specified by the LABEL instruction in a Dockerfile) to a container without validating them. This lack of validation can allow an attacker to execute arbitrary commands on the host system if a plugin processes these container labels for certain operations.

Detection Guidance

This vulnerability affects containerd versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10. To detect if your system is vulnerable, first check the installed containerd version.

Run the command: containerd --version or containerd -v to determine the installed version.
If the version is older than the fixed versions mentioned, your system is vulnerable.

Additionally, inspect running containers for suspicious or untrusted image labels that might be exploited by plugins consuming container labels.

Use docker inspect or crictl inspect commands on containers to view image labels, for example: docker inspect <container_id> | grep -i label
Monitor for unusual plugin activity or unexpected command executions originating from container label processing.

The best mitigation is to update containerd to a fixed version. Until then, only use trusted container images.

Impact Analysis

This vulnerability can have a severe impact as it allows an attacker to execute arbitrary commands on the host system running containerd. This could lead to unauthorized access, control over the host, potential data breaches, and disruption of services. The risk is especially high if untrusted container images are used, as malicious labels could be crafted to exploit this flaw.

Compliance Impact

The provided information does not specify how this vulnerability directly affects compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, users should immediately update containerd to the fixed versions: 1.7.33, 2.0.10, 2.1.9, 2.2.5, or 2.3.2.

As a temporary measure before updating, only trusted container images should be used to reduce the risk of exploitation.

Hi! I’m here to help you understand CVE-2026-53488. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70