CVE-2026-50195VulnerabilityPublished 20 Jun 2026Updated 19 Oct 2026

Issue with containerd CRI Plugin - CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262

Source AWS Security Bulletins

Compare

Mentioned vulnerabilities

Not known to be exploited.

Data as of 5 Nov 2026, 00:01 UTC

Severity

Medium

Rated Medium by Threat Radar from the AWS Security Bulletins text · No CVSS score from NVD or the CNA

EPSS: 0.3% chance of exploitation in 30 days – higher than 23% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
Public on cve.org; its publication date is not in this record
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

Patches are available for containerd upstream and for GKE Container-Optimized OS node images from versions 1.30 to 1.36. Users should upgrade to these patched versions or later. Ubuntu node image patches are still in progress; until available, restrict Pod creation permissions to trusted users only, avoid using IfNotPresent or Never image pull policies for untrusted workloads (use Always instead), and restrict or monitor checkpoint/restore features. For CVE-2026-53492, on nodes without CDI usage, remove or relocate host CDI specifications from default directories to prevent exploitation. AWS is deploying patched runtimes for managed services; self-managed deployments should upgrade containerd promptly.

Description

Bulletin ID: 2026-046-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/18/2026 17:30 PM PDT Description: containerd is an open-source container runtime used by Kubernetes via the Container Runtime Interface (CRI) plugin. It underpins AWS managed container services including Amazon Elastic Kubernetes Service (Amazon EKS), Amazon Elastic Container Service (Amazon ECS), AWS Fargate, Bottlerocket, and Amazon Linux. AWS identified five issues in the containerd CRI plugin affecting versions 1.7 through 2.3. - CVE-2026-50195 (GHSA-cvxm-645q-p574) - CRI checkpoint import, local image tag poisoning - CVE-2026-53488 (GHSA-xhf5-7wjv-pqxp) - image-config LABEL -> host-root command exec - CVE-2026-53492 (GHSA-33vj-92qq-66hc) - CDI annotation smuggling during checkpoint restore - CVE-2026-53489 (GHSA-rgh6-rfwx-v388) - arbitrary host file read via symlink in checkpoint restore - CVE-2026-47262 (GHSA-jpcc-p29g-p8mq) - image-triggered runtime DoS Impacted versions: containerd 1.7, 2.0, 2.1, 2.2, 2.3 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Impact

Attackers with permissions to create Pods can bypass Kubernetes security boundaries, leading to host compromise, arbitrary code execution, cache poisoning, unauthorized host file access, and denial of service on nodes running vulnerable containerd versions. These vulnerabilities affect containerd used in Kubernetes runtimes including GKE and AWS managed container services. The requirement for cluster privileges to create Pods reduces the risk to some extent but does not eliminate it. The vulnerabilities impact containerd versions 1.7, 2.0, 2.1, 2.2, and 2.3. GKE Sandbox (gVisor) does not mitigate these host compromise vectors.

Summary

Five vulnerabilities were discovered in the containerd CRI plugin affecting versions 1.7 through 2.3. CVE-2026-50195 allows image cache poisoning via unvalidated checkpoint image references, enabling cross-pod code execution. CVE-2026-53488 propagates image config labels without validation, allowing arbitrary host command execution. CVE-2026-53492 improperly trusts CDI annotations during container restoration, permitting injection of host mounts and device nodes. CVE-2026-53489 restores container logs without validating symlink paths, enabling arbitrary host file reads. CVE-2026-47262 causes memory exhaustion leading to denial of service. These vulnerabilities require cluster privileges to create Pods for exploitation. Patches are available in upstream containerd releases and GKE Container-Optimized OS node images from versions 1.30 to 1.36. Ubuntu node image patches are pending. AWS is deploying patched runtimes for managed services. Mitigations include restricting Pod creation permissions, using Always image pull policy for untrusted workloads, and restricting checkpoint/restore usage.

References

aws.amazon.com/security/security-bulletins/rss/2026-046-aws/ (opens in a new tab)

Community reviews

Loading reviews…