CVE-2020-15157: containerd v1.2.x Image Pull Credentials Leakage
Summary
CVE-2020-15157: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd. Affects github.com/containerd/containerd versions < 1.2.14. Fixed in 1.2.14. How to fix ↓
Also tracked for
- containerd · Debian:11
The same CVE-2020-15157 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/containerd/containerd, an open-source container runtime for Linux. It is written in Go and provides a platform-agnostic interface for managing containers. containerd is widely used in various container orchestration systems and provides functionality for image management, container execution, and storage. However, versions 1.2.x of containerd are vulnerable to a credential leakage issue during image pull operations.
Vulnerability Detail
The vulnerability in containerd v1.2.x allows for the leakage of credentials during image pull operations. An attacker can coerce the containerd runtime into revealing sensitive credentials, potentially leading to unauthorized access or further attacks. This vulnerability arises due to a flaw in the image pull process, specifically in the handling of credentials. By exploiting this vulnerability, an attacker can obtain sensitive information such as usernames, passwords, or access tokens, compromising the security of the system.
How To Fix
Latest published version: v1.7.36 as of 22 Oct 2026
go get github.com/containerd/containerd@v1.7.36Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.14
This is the first release that contains the fix.
go get github.com/containerd/containerd@v1.2.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to containerd version 1.2.14 or later.
Conclusion
The vulnerability in containerd v1.2.x allows for the leakage of credentials during image pull operations. To mitigate this risk, it is crucial to upgrade to containerd version 1.2.14 or later. This fix addresses the flaw in the image pull process and prevents the unauthorized disclosure of sensitive credentials.
See every vulnerability recorded for github.com/containerd/containerd →
FAQ
containerd is an open-source container runtime for Linux, providing a platform-agnostic interface for managing containers.
The vulnerability allows for the leakage of credentials during image pull operations, potentially leading to unauthorized access or further attacks.
To fix this vulnerability, upgrade to containerd version 1.2.14 or later.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is necessary.
You can find more information about this vulnerability in the Open Source Vulnerability database at https://pkg.go.dev/vuln/GO-2022-0803.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containerd/containerd.
