Inheritable Linux Process Capabilities in containerd
Summary
GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd. Affects github.com/containerd/containerd across 2 version ranges.
< 1.5.11
>= 1.6.0, < 1.6.2
Fixed in 1.5.11 or 1.6.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
containerd is an open-source container runtime that provides a platform-agnostic interface for managing containers. It is written in Go and is widely used in container orchestration systems like Kubernetes. This vulnerability affects the github.com/containerd/containerd package.
Vulnerability Detail
The vulnerability arises from containerd being started with non-empty inheritable Linux process capabilities. This can lead to privilege escalation attacks, where an attacker with limited privileges can exploit this vulnerability to gain elevated privileges within the container runtime environment. The impact of this vulnerability can be severe, as it allows an attacker to perform unauthorized actions and potentially compromise the entire container infrastructure.
How To Fix
Latest published version: v1.7.36 as of 22 Oct 2026
go get github.com/containerd/containerd@v1.7.36Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.5.111.5.11go get github.com/containerd/containerd@v1.5.11 -
>= 1.6.0, < 1.6.21.6.2go get github.com/containerd/containerd@v1.6.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the containerd package to the fixed versions mentioned above.
Conclusion
The inheritable Linux process capabilities vulnerability in containerd can lead to privilege escalation attacks and compromise the security of containerized environments. It is crucial to update the containerd package to the fixed versions mentioned above to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/containerd/containerd →
FAQ
containerd is an open-source container runtime used in container orchestration systems like Kubernetes.
The vulnerability allows for privilege escalation attacks, potentially compromising the entire container infrastructure.
Update the containerd package to version 1.5.11 or later, or version 1.6.2 or later.
No, updating the containerd package is the only known solution.
You can find more information about this vulnerability in the vulnerability report at https://pkg.go.dev/vuln/GO-2024-2846
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containerd/containerd.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
