CVE-2026-46680: containerd User ID Handling Bypass Allows runAsNonRoot Evasion
Summary
CVE-2026-46680: containerd user ID handling bypass allows runAsNonRoot evasion. Affects github.com/containerd/containerd versions >= 1.7.27, < 1.7.32. Fixed in 1.7.32. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
containerd is an industry-standard core container runtime that manages the complete container lifecycle, including image transfer, storage, and execution. It is widely used in cloud-native environments, particularly with Kubernetes. The vulnerability in question arises from improper handling of user IDs, which can lead to security breaches in environments that enforce non-root user policies.
Vulnerability Detail
A bug was identified in containerd where containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username. If a malicious image provides an /etc/passwd file mapping this large numeric string to root, the container runs as root (UID 0). This bypasses the Kubernetes runAsNonRoot restriction, potentially allowing unauthorized access and control over the container, which can lead to significant security risks.
How To Fix
Latest published version: v1.7.36 as of 22 Oct 2026
go get github.com/containerd/containerd@v1.7.36Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.32
This is the first release that contains the fix.
go get github.com/containerd/containerd@v1.7.32Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Ensure that only trusted images are used and that only trusted users have permissions to import images. Additionally, enforcing a specific numeric runAsUser in the Kubernetes Pod securityContext can override the USER directive in the image and prevent the bypass. Here is an example of how to set this in your Kubernetes Pod configuration:
apiVersion: v1 kind: Pod metadata: name: example-pod spec: securityContext: runAsUser: 1000 containers:
- name: example-container image: example-image
Conclusion
CVE-2026-46680 represents a significant security risk for containerd users, particularly in Kubernetes environments. It is crucial to update to the patched versions or implement workarounds to ensure that your containers run securely as non-root users.
See every vulnerability recorded for github.com/containerd/containerd →
FAQ
CVE-2026-46680 is a vulnerability in containerd that allows bypassing the runAsNonRoot restriction, potentially allowing containers to run as root.
This vulnerability can lead to containers running as root, which undermines the security model of Kubernetes that aims to restrict containers to non-root users.
Versions of containerd prior to 2.3.1, 2.2.4, 2.0.9, and 1.7.32 are affected by this vulnerability.
If updating is not possible, ensure that only trusted images are used and set a specific runAsUser in your Kubernetes Pod securityContext to mitigate the risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containerd/containerd.
