CVE-2026-53488: containerd CRI passes image LABELs to containers, enabling host commands

Critical 9.4 EPSS 0.2% containerd

containerd's CRI plugin (the interface Kubernetes uses) copies labels from an image's config (Dockerfile LABEL instructions) onto the container without validation. If the node runs a plugin that acts on container labels, a malicious image can make it execute an arbitrary command on the host. The containerd project rates this critical; anyone who can get an untrusted image pulled and run on a node is a potential attacker. Debian 12 and 13 had no fixed containerd package when this was written.

• CVE-2026-53488CVE identifier
• 9.4CVSS 4.0 base score (critical)
• 0.2%EPSS: chance of exploitation in the next 30 days (higher than 7% of CVEs)
• 2026-07-01published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

Affected and fixed versions

Affected:

• containerd 1.7.0 before 1.7.33
• containerd 2.0.0 before 2.0.10
• containerd 2.1.0 before 2.1.9
• containerd 2.2.0 before 2.2.5
• containerd 2.3.0 before 2.3.2

Fixed in:

• containerd 1.7.33
• containerd 2.0.10
• containerd 2.1.9
• containerd 2.2.5
• containerd 2.3.2

Am I affected?

containerd --version
sudo ctr plugins ls | grep -i cri
dpkg -l 'containerd*' | grep ^ii
rpm -qa | grep -i containerd

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

sudo apt update
sudo apt install --only-upgrade containerd

sudo apt update
sudo apt install --only-upgrade containerd containerd-app
sudo systemctl restart containerd

sudo dnf upgrade --refresh containerd (EPEL; Docker repo: containerd.io)

sudo dnf upgrade --refresh containerd

sudo zypper refresh
sudo zypper update containerd

sudo dnf upgrade --releasever=latest containerd

sudo pacman -Syu

apk update && apk upgrade containerd

not supported

Upgrade containerd to 1.7.33, 2.0.10, 2.1.9, 2.2.5 or 2.3.2 (or later) from https://github.com/containerd/containerd/releases and restart the containerd service. For managed Kubernetes, upgrade node images to a release that ships a fixed containerd.

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

If you cannot patch yet

• containerd project: ensure that only trusted images are used (for example restrict registries with an admission policy).

Related vulnerabilities

• CVE-2026-50195
• CVE-2026-53492
• CVE-2026-53489
• CVE-2026-95837

Sources

• containerd advisory GHSA-xhf5-7wjv-pqxp
• CVE record CVE-2026-53488
• Debian security tracker
• Ubuntu CVE page
• Red Hat CVE page
• CVE-2026-53488 on NVD

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.