CVE-2026-53488: containerd CRI Plugin Label Propagation Vulnerability (CVSS 8.8)

Technical summary

The CRI (Container Runtime Interface) plugin in containerd propagates unvalidated labels from image configuration directly to container metadata. Labels originate from LABEL instructions in Dockerfiles and are stored in the image's config JSON. When these labels are used by downstream plugins or orchestration tooling to perform operations—such as setting environment variables, constructing command arguments, or invoking system utilities—insufficient input validation allows an attacker to inject malicious content. The vulnerability is rooted in CWE-20 (Improper Input Validation) and requires local access to the container runtime, making it a privilege escalation vector when combined with a plugin that interprets labels without escaping or validation.

Business impact

Container-based infrastructure relying on containerd could face privilege escalation risks if untrusted or user-controlled images are executed. A local user (or a compromised application running in a container) could escape containment and execute commands with the privileges of the containerd daemon or host. This threatens workloads running on Kubernetes clusters, Docker-compatible environments, and other container orchestration platforms using containerd. The impact cascades across multi-tenant environments where image provenance cannot be fully guaranteed.

Affected systems

containerd versions 1.7.x (before 1.7.33), 2.0.x (before 2.0.10), 2.1.x (before 2.1.9), 2.2.x (before 2.2.5), and 2.3.x (before 2.3.2) are vulnerable. Any deployment using these versions is at risk if plugins or tooling consume container labels without validation. Kubernetes distributions using containerd as the default runtime, OpenStack deployments, and standalone container hosts are potential targets. Verify your specific containerd version and patch status immediately.

Exploitability

Exploitation requires local access to the container runtime and the ability to deploy or manipulate a container image with malicious labels. The attack does not require elevated privileges to initiate—a standard user or containerized workload can trigger it. However, the actual impact (arbitrary host command execution) depends on the presence of a plugin that consumes labels unsafely. The low complexity (AC:L) and lack of user interaction (UI:N) suggest an attacker can reliably exploit this if the necessary plugin is present. The high CVSS score (8.8) reflects the potential for container escape and lateral movement within an infrastructure.

Remediation

Immediately upgrade containerd to a patched version: 1.7.33, 2.0.10, 2.1.9, 2.2.5, or 2.3.2 (or later). Verify your current version with `containerd --version`. Coordinate the upgrade with your container orchestration platform (e.g., Kubernetes) to ensure compatibility. Test in a staging environment before production rollout to avoid service disruption. Additionally, audit running images for suspicious labels and restrict image sources to trusted registries.

Patch guidance

Obtain updates from the Linux Foundation's containerd project repositories. For Kubernetes environments, verify that your distribution has published a patched version of containerd and follow its release notes for upgrade procedures. Cloud providers and distributions (e.g., Docker, Rancher, OpenShift) may have their own release cadences; check their advisories. For manual installations, download the patched binary from the official containerd releases page and perform a controlled rollout. Test label handling in your environment post-upgrade, particularly with any custom plugins that process container metadata.

Detection guidance

Monitor for unexpected command execution on hosts where containerd runs, particularly tied to container lifecycle events. Audit container image labels for suspicious content using tools like `docker inspect` or `crictl inspect`. Review container runtime logs for plugin errors or warnings related to label processing. Implement image scanning policies that validate or restrict label content before deployment. In Kubernetes environments, use admission controllers or policy engines (e.g., OPA/Gatekeeper) to reject images with suspicious labels. Look for anomalous process trees spawned from containerd or CRI plugin processes.

Why prioritize this

This vulnerability merits immediate attention despite not appearing on CISA's KEV list. The CVSS score of 8.8 (HIGH) combined with local exploitability and the potential for container escape makes it a critical risk in any containerized infrastructure. The widespread adoption of containerd in Kubernetes and production environments elevates the blast radius. Organizations running multiple containerd hosts should treat patching as urgent, particularly if untrusted images or multi-tenant workloads are present. The fix is straightforward and low-risk, making rapid remediation a clear priority.

Risk score, explained

The 8.8 CVSS score reflects high severity due to: (1) local attack vector (AV:L) enabling container-to-host attacks, (2) low attack complexity (AC:L) with no special conditions, (3) low privilege requirement (PR:L) reducing the barrier to exploitation, (4) high impact across confidentiality, integrity, and availability (C:H/I:H/A:H), and (5) scope change (S:C) allowing escape from the container boundary. The lack of CISA KEV inclusion does not diminish the actual risk; it reflects early disclosure and limited observed exploitation rather than severity.

Frequently asked questions