CVE-2026-50195: Containerd Local Image Tag Poisoning Vulnerability
Summary
CVE-2026-50195: containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
The same CVE-2026-50195 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Containerd is an industry-standard core container runtime that manages the complete container lifecycle, including image transfer, storage, and execution. It is widely used in cloud-native environments and is a critical component of various container orchestration platforms. The vulnerability in question arises from the CRI checkpoint import functionality, which can be exploited to poison local image tags, potentially leading to unauthorized access or execution of malicious containers.
Vulnerability Detail
The vulnerability allows an attacker to exploit the CRI checkpoint import feature in containerd, enabling local image tag poisoning. This occurs when an attacker can manipulate the image tags used by the container runtime, leading to the execution of unintended or malicious container images. The ramifications include potential security breaches, unauthorized access to sensitive data, and the execution of harmful code within the container environment. This vulnerability affects versions of containerd from 0.0.0 up to 2.3.2, making it critical for users to address it promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider restricting access to the CRI checkpoint import functionality or implementing strict validation of image tags before they are processed by the container runtime. This can help mitigate the risk of tag poisoning until a full update can be applied.
Conclusion
The CVE-2026-50195 vulnerability in containerd poses significant risks due to its potential for local image tag poisoning. It is crucial for users to update to the patched versions to safeguard their applications. Implementing workarounds can provide temporary relief while ensuring that the system remains secure.
See every vulnerability recorded for github.com/containerd/containerd →
FAQ
CVE-2026-50195 is a vulnerability in containerd that allows local image tag poisoning through the CRI checkpoint import feature.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
The risks include unauthorized access to sensitive data, execution of malicious containers, and potential security breaches in your containerized applications.
You can update containerd by running 'go get github.com/containerd/containerd@v2.3.2' in your terminal to install the latest patched version.
Yes, you can restrict access to the CRI checkpoint import functionality and validate image tags before processing them as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containerd/containerd.
