CVE-2022-23648: Insecure handling of image volumes in containerd
Summary
CVE-2022-23648: containerd CRI plugin: Insecure handling of image volumes. Affects github.com/containerd/containerd across 3 version ranges.
< 1.4.13
>= 1.5.0, < 1.5.10
>= 1.6.0, < 1.6.1
Fixed in 1.4.13, 1.5.10 or 1.6.1, depending on the release line you run. How to fix ↓
Also tracked for
- containerd · Debian:11
The same CVE-2022-23648 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Containerd is an open-source container runtime that provides a reliable and scalable foundation for container deployments. It is widely used in container orchestration systems like Kubernetes. The CRI (Container Runtime Interface) plugin in containerd allows Kubernetes and crictl to interact with containerd. This vulnerability affects containerd's CRI implementation and can be exploited by specially-crafted image configurations.
Vulnerability Detail
The bug in containerd's CRI implementation allows containers to gain access to read-only copies of arbitrary files and directories on the host. This means that containers launched through containerd's CRI implementation may bypass policy-based enforcement, such as Kubernetes Pod Security Policies, and potentially expose sensitive information. This vulnerability has a CVSS score of 7.5.
How To Fix
Latest published version: v1.7.36 as of 22 Oct 2026
go get github.com/containerd/containerd@v1.7.36Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.4.131.4.13go get github.com/containerd/containerd@v1.4.13 -
>= 1.5.0, < 1.5.101.5.10go get github.com/containerd/containerd@v1.5.10 -
>= 1.6.0, < 1.6.11.6.1go get github.com/containerd/containerd@v1.6.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, it is recommended to only use trusted images. By ensuring that only trusted images are used, the risk of exploiting this vulnerability can be mitigated.
Conclusion
The vulnerability in containerd's CRI implementation can allow containers to access sensitive information on the host. It is important to update to the fixed versions of containerd and follow best practices by using trusted images. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/containerd/containerd →
FAQ
Containerd is an open-source container runtime used in container orchestration systems like Kubernetes.
The CRI (Container Runtime Interface) plugin in containerd allows Kubernetes and crictl to interact with containerd.
This vulnerability allows containers to access read-only copies of arbitrary files and directories on the host, potentially bypassing policy-based enforcement and exposing sensitive information.
To fix this vulnerability, update containerd to versions 1.6.1, 1.5.10, or 1.4.13.
Yes, using only trusted images can mitigate the risk of exploiting this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containerd/containerd.
