Vulnerability Description
containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linuxfoundation | Containerd | >= 1.7.0, < 1.7.33 |
Related Weaknesses (CWE)
References
- https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxpMitigationVendor Advisory
FAQ
What is CVE-2026-53488?
CVE-2026-53488 is a vulnerability with a CVSS score of 8.8 (HIGH). containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to ...
How severe is CVE-2026-53488?
CVE-2026-53488 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-53488?
Check the references section above for vendor advisories and patch information. Affected products include: Linuxfoundation Containerd.