containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the Kubernetes runAsNonRoot restriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user. This issue has been fixed in versions 1.7.32, 2.0.9, 2.2.4 and 2.3.1.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21213-1 advisory.

    This update for containerd fixes the following issues

    Update to 1.7.33:

    - CVE-2024-25621: overly broad default permission vulnerability (bsc#1253126).
    - CVE-2025-64329: goroutine leaks can lead to memory exhaustion on the host (bsc#1253132).
    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header (bsc#1260296).
    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265794).
    - CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input with a     missing       encrypted key can lead to a denial of service (bsc#1262948).
    - CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial     of service       (bsc#1262266).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266640).
    - CVE-2026-46680: containerd user ID handling bypass allows runAsNonRoot evasion (bsc#1268355).
    - CVE-2026-47262: Denial of Service (DoS) condition via a maliciously crafted image (bsc#1268441).
    - CVE-2026-53488: CRI plugin propagates labels from an image config to a container without validation     (bsc#1268430).

    Changes for containerd:

     * https://github.com/containerd/containerd/releases/tag/v1.7.33
     * https://github.com/containerd/containerd/releases/tag/v1.7.32
     * https://github.com/containerd/containerd/releases/tag/v1.7.31
     * https://github.com/containerd/containerd/releases/tag/v1.7.30
     * https://github.com/containerd/containerd/releases/tag/v1.7.29
     * https://github.com/containerd/containerd/releases/tag/v1.7.28

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1,     containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are     incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted image provides an     /etc/passwd file mapping this large numeric string to root, the container ultimately runs as root (UID 0).
    This allows the Kubernetes runAsNonRoot restriction to be bypassed, causing unexpected behavior for     environments that require containers to run as a non-root user. This issue has been fixed in versions     1.7.32, 2.0.9, 2.2.4 and 2.3.1. (CVE-2026-46680)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21072-1 advisory.

    This update for trivy fixes the following issues

    Update to version 0.71.2:

    - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to     DoS via infinite       loops, panics or resource consumption (bsc#1267268).
    - CVE-2026-46680: github.com/containerd/containerd/v2/pkg/oci: containerd user ID handling bypass allows     runAsNonRoot       evasion (bsc#1268356).
    - CVE-2026-47262: github.com/containerd/containerd/v2/pkg/oci: Denial of Service (DoS) condition via a     maliciously       crafted image (bsc#1268440).
    - CVE-2026-50195: containerd: fails to validate the image references specified within a checkpoint image's       configuration (bsc#1268399).
    - CVE-2026-53488: containerd: CRI plugin propagates labels from an image config to a container without     validation       (bsc#1268400).
    - CVE-2026-53489: containerd: CRI plugin restores container.log from a checkpoint image without validating     a symlinked       path (bsc#1268404).
    - CVE-2026-53492: containerd: improperly trusts Container Device Interface (CDI) annotations found within     untrusted       checkpoint image metadata during container restoration (bsc#1268403).

    Changes for trivy:

     * release: v0.71.2 [release/v0.71] (#10871)
     * fix(deps): bump alpine to 3.24.1 [backport: release/v0.71] (#10870)
     * chore(deps): bump the common group with 4 updates [backport: release/v0.71] (#10867)
     * fix(oci): validate artifact filename
     * fix: forward ospkg detector options through ospkg.NewScanner
     * fix(vex): load VEX documents from within the repository        directory
     * fix: surface the original analysis error instead of context        cancellation
     * ci: expect GitHub App bot as backport PR author

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Containerd on the remote host is 1.7.27 prior to 1.7.32, 2.0.4 prior to 2.0.9, 2.1.x prior to 2.2.4, or 2.3.x prior to 2.3.1. It is, therefore, affected by a security bypass vulnerability. A bug was found in containerd where containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the Kubernetes runAsNonRoot restriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1,
    containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are
    incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted image provides an
    /etc/passwd file mapping this large numeric string to root, the container ultimately runs as root (UID 0).
    This allows the Kubernetes runAsNonRoot restriction to be bypassed, causing unexpected behavior for
    environments that require containers to run as a non-root user. This issue has been fixed in versions
    1.7.32, 2.0.9, 2.2.4 and 2.3.1. (CVE-2026-46680)

ID	Name	Product	Family	Severity
325038	openSUSE 16 Security Update : containerd (openSUSE-SU-2026:21213-1)	Nessus	SuSE Local Security Checks	critical
324893	Linux Distros Unpatched Vulnerability : CVE-2026-46680	Nessus	Misc.	high
324052	openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21072-1)	Nessus	SuSE Local Security Checks	critical
318178	Containerd 1.7.27 < 1.7.32 / 2.0.4 < 2.0.9 / 2.1.x < 2.2.4 / 2.3.x < 2.3.1 runAsNonRoot Bypass	Nessus	Misc.	critical
442292	SCA: security update for github.com/containerd/containerd, github.com/containerd/containerd/v2 (GHSA-fqw6-gf59-qr4w)	Tenable Cloud Security	SCA Checks	high
442292	SCA: security update for github.com/containerd/containerd, github.com/containerd/containerd/v2 (GHSA-fqw6-gf59-qr4w)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-46680

high

Tenable Plugins

critical

high

critical

critical

high

high