Five vulnerabilities were discovered in the containerd CRI plugin affecting versions 1.7 through 2.3. CVE-2026-50195 allows image cache poisoning via unvalidated checkpoint image references, enabling cross-pod code execution. CVE-2026-53488 propagates image config labels without validation, allowing arbitrary host command execution. CVE-2026-53492 improperly trusts CDI annotations during container restoration, permitting injection of host mounts and device nodes. CVE-2026-53489 restores container logs without validating symlink paths, enabling arbitrary host file reads. CVE-2026-47262 causes memory exhaustion leading to denial of service. These vulnerabilities require cluster privileges to create Pods for exploitation. Patches are available in upstream containerd releases and GKE Container-Optimized OS node images from versions 1.30 to 1.36. Ubuntu node image patches are pending. AWS is deploying patched runtimes for managed services. Mitigations include restricting Pod creation permissions, using Always image pull policy for untrusted workloads, and restricting checkpoint/restore usage.

Attackers with permissions to create Pods can bypass Kubernetes security boundaries, leading to host compromise, arbitrary code execution, cache poisoning, unauthorized host file access, and denial of service on nodes running vulnerable containerd versions. These vulnerabilities affect containerd used in Kubernetes runtimes including GKE and AWS managed container services. The requirement for cluster privileges to create Pods reduces the risk to some extent but does not eliminate it. The vulnerabilities impact containerd versions 1.7, 2.0, 2.1, 2.2, and 2.3. GKE Sandbox (gVisor) does not mitigate these host compromise vectors.

Patches are available for containerd upstream and for GKE Container-Optimized OS node images from versions 1.30 to 1.36. Users should upgrade to these patched versions or later. Ubuntu node image patches are still in progress; until available, restrict Pod creation permissions to trusted users only, avoid using IfNotPresent or Never image pull policies for untrusted workloads (use Always instead), and restrict or monitor checkpoint/restore features. For CVE-2026-53492, on nodes without CDI usage, remove or relocate host CDI specifications from default directories to prevent exploitation. AWS is deploying patched runtimes for managed services; self-managed deployments should upgrade containerd promptly.