CVE-2026-53489

containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore

State: Published
Severity: 8.2 High
Published: Jul 1, 2026
Updated: Jul 2, 2026
Reserved: Jun 9, 2026

Description

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.

Scores

CVSS	Score	Vector	Source
4.0	8.2 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N	GitHub_M

Weaknesses

CWE-61 UNIX Symbolic Link (Symlink) Following

Affected Products

Product	Versions
containerdcontainerd	>= 2.1.0, < 2.1.9Affected >= 2.2.0, < 2.2.5Affected >= 2.3.0, < 2.3.2Affected

References

https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.