CVE-2026-53492: Vulnerability in github.com/containerd/containerd - CDI Annotation Smuggling
Summary
CVE-2026-53492: containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
The same CVE-2026-53492 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/containerd/containerd is an open-source container runtime that provides a high-level API for managing container lifecycles. It is widely used in cloud-native environments for its efficiency and flexibility. The package supports various container operations, including image management, execution, and checkpointing. However, it has been found to be vulnerable to a CDI annotation smuggling issue, which could lead to unauthorized access or manipulation of container states.
Vulnerability Detail
The vulnerability identified as CVE-2026-53492 involves a flaw in the containerd CRI checkpoint restore process, specifically related to the handling of CDI annotations. This smuggling can allow attackers to inject malicious annotations into the checkpoint restore process, potentially leading to unauthorized access or manipulation of container data. The vulnerability affects versions of the package starting from its initial release, with specific patched versions available to mitigate the risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the available patches as soon as possible to mitigate the risk.
Conclusion
CVE-2026-53492 is a significant vulnerability in the github.com/containerd/containerd package that poses risks related to CDI annotation smuggling. It is essential for users of this package to update to the patched versions to ensure the security of their applications. Regular monitoring for vulnerabilities, such as through Vulert, can help maintain the integrity of your software.
See every vulnerability recorded for github.com/containerd/containerd →
FAQ
CVE-2026-53492 is a vulnerability in the github.com/containerd/containerd package that allows for CDI annotation smuggling during the checkpoint restore process.
This vulnerability can potentially allow unauthorized access or manipulation of container data, which could lead to security breaches in your application.
All versions of github.com/containerd/containerd starting from its initial release are affected, with specific patched versions available.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is crucial to prioritize updating to a patched version to mitigate the risk associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containerd/containerd.
