containerd up to 2.3.1 CRI Plugin access control

Summaryinfo

A vulnerability was found in containerd up to 1.7.32/2.0.9/2.1.8/2.2.4/2.3.1 and classified as critical. This affects an unknown part of the component CRI Plugin. Such manipulation leads to access control. This vulnerability is uniquely identified as CVE-2026-53488. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in containerd up to 1.7.32/2.0.9/2.1.8/2.2.4/2.3.1. It has been rated as critical. Affected by this issue is an unknown code of the component CRI Plugin. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-53488. The exploitation is known to be easy. The attack may be launched remotely. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

The vulnerability scanner Nessus provides a plugin with the ID 321802 (Linux Distros Unpatched Vulnerability : CVE-2026-53488), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.7.33, 2.0.10, 2.1.9, 2.2.5 or 2.3.2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (321802) and CERT Bund (WID-SEC-2026-2009). Once again VulDB remains the best source for vulnerability data.

Affected

• Google Cloud Platform

Productinfo

Type

• Virtualization Software

Name

• containerd

Version

• 1.7.0
• 1.7.1
• 1.7.2
• 1.7.3
• 1.7.4
• 1.7.5
• 1.7.6
• 1.7.7
• 1.7.8
• 1.7.9
• 1.7.10
• 1.7.11
• 1.7.12
• 1.7.13
• 1.7.14
• 1.7.15
• 1.7.16
• 1.7.17
• 1.7.18
• 1.7.19
• 1.7.20
• 1.7.21
• 1.7.22
• 1.7.23
• 1.7.24
• 1.7.25
• 1.7.26
• 1.7.27
• 1.7.28
• 1.7.29
• 1.7.30
• 1.7.31
• 1.7.32
• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9
• 2.1.0
• 2.1.1
• 2.1.2
• 2.1.3
• 2.1.4
• 2.1.5
• 2.1.6
• 2.1.7
• 2.1.8
• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.3.0
• 2.3.1

Website

• Product: https://github.com/containerd/containerd/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion