CVE-2026-53488: containerd CRI Image-Config LABEL Flaw Leading to Host Command Execution
Summary
CVE-2026-53488: Impact A bug was found in containerd where the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. Affects github.com/containerd/containerd versions >= 1.7.0, < 1.7.33. Fixed in 1.7.33. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
containerd is an industry-standard core container runtime that manages the complete lifecycle of containers on a host system. It is widely used in cloud-native environments to facilitate the deployment and management of containerized applications. The CRI (Container Runtime Interface) plugin of containerd allows Kubernetes to interact with containerd, enabling seamless orchestration of containers. However, a vulnerability has been identified in the way containerd handles image labels, which can lead to severe security risks.
Vulnerability Detail
A bug was discovered in containerd where the CRI plugin improperly propagates labels from an image configuration (specifically the LABEL instruction in a Dockerfile) to a container without adequate validation. This oversight can allow an attacker to execute arbitrary commands on the host system through a plugin that utilizes container labels for various operations. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).
How To Fix
Latest published version: v1.7.36 as of 22 Oct 2026
go get github.com/containerd/containerd@v1.7.36Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.33
This is the first release that contains the fix.
go get github.com/containerd/containerd@v1.7.33Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, ensure that only trusted images are used in your containerized applications to mitigate the risk of this vulnerability until a patch can be applied.
Conclusion
The vulnerability identified as CVE-2026-53488 poses a significant risk to users of containerd due to improper handling of image labels, which can lead to command execution on the host. Users are strongly advised to update to the patched versions to mitigate this risk and ensure the security of their containerized applications.
See every vulnerability recorded for github.com/containerd/containerd →
FAQ
CVE-2026-53488 is a vulnerability in containerd that allows for command execution on the host due to improper handling of image labels.
If your applications use containerd and untrusted images, this vulnerability could allow an attacker to execute arbitrary commands on your host system.
Versions of containerd prior to 2.3.2, 2.2.5, 2.1.9, 2.0.10, and 1.7.33 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containerd/containerd.
