CVE-2020-15257: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd
Summary
CVE-2020-15257: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd. Affects github.com/containerd/containerd across 2 version ranges.
< 1.3.9
>= 1.4.0, < 1.4.3
Fixed in 1.3.9 or 1.4.3, depending on the release line you run. How to fix ↓
Also tracked for
- containerd · Debian:11
The same CVE-2020-15257 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/containerd/containerd, which is written in Go. containerd is an open-source container runtime that provides a reliable and scalable foundation for container deployments. It manages the complete container lifecycle, including image transfer and storage, container execution, and supervision. The vulnerability in question exposes the containerd-shim API to host network containers, potentially leading to unauthorized access and malicious activities.
Vulnerability Detail
The vulnerability (CVE-2020-15257) arises from the containerd-shim API being exposed to host network containers. This allows containers running on the host network to interact with the containerd-shim API, which can lead to unauthorized access and potential security breaches. Attackers could exploit this vulnerability to execute arbitrary code, escalate privileges, or perform other malicious actions within the containerd environment. The vulnerability affects versions 0.x, 1.3.9, 1.4.0, and 1.4.3 of the github.com/containerd/containerd package.
How To Fix
Latest published version: v1.7.36 as of 22 Oct 2026
go get github.com/containerd/containerd@v1.7.36Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.3.91.3.9go get github.com/containerd/containerd@v1.3.9 -
>= 1.4.0, < 1.4.31.4.3go get github.com/containerd/containerd@v1.4.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to ensure that containers running on the host network are properly isolated and have restricted access to sensitive APIs and resources.
Conclusion
The vulnerability (CVE-2020-15257) in the github.com/containerd/containerd package exposes the containerd-shim API to host network containers, potentially leading to unauthorized access and malicious activities. It is crucial to upgrade to the fixed versions (1.3.9 or 1.4.3) to mitigate the risk and ensure the security of the containerd environment.
See every vulnerability recorded for github.com/containerd/containerd →
FAQ
containerd is an open-source container runtime that manages the complete container lifecycle, including image transfer and storage, container execution, and supervision.
The vulnerability allows host network containers to access the containerd-shim API, potentially leading to unauthorized access and malicious activities within the containerd environment.
Attackers can exploit this vulnerability to execute arbitrary code, escalate privileges, or perform other malicious actions within the containerd environment.
Versions 0.x, 1.3.9, 1.4.0, and 1.4.3 of the github.com/containerd/containerd package are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to a fixed version of the github.com/containerd/containerd package. For versions 0.x, the vulnerability is fixed in version 1.3.9. For versions 1.4.0, the vulnerability is fixed in version 1.4.3.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containerd/containerd.
