PT-2026-51057 · Unknown · Kubernetes Containerd

Published 2026-06-19 · Updated 2026-06-22 · CVE-2026-53489

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions containerd versions prior to 2.1.9 containerd versions prior to 2.2.5 containerd versions prior to 2.3.2

Description A bug in the CRI plugin allows the restoration of container.log from a checkpoint image without validating a symlinked path. This can lead to an arbitrary file read on the host system when using kubectl logs.

Recommendations Update to version 2.1.9. Update to version 2.2.5. Update to version 2.3.2. Ensure that only trusted images and checkpoints are used.

Fix

Weakness Enumeration

CWE-61

Related Identifiers

CVE-2026-53489

GHSA-RGH6-RFWX-V388

Affected Products

Kubernetes Containerd

References · 5

• https://osv.dev/vulnerability/GHSA-rgh6-rfwx-v388 · Vendor Advisory
• https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388 · Note
• https://github.com/containerd/containerd · Note
• https://t.me/k8security/1876 · Telegram Post
• https://twitter.com/dailycve/status/2068099096133382182 · Twitter Post