Detections
Analytics

Alpine: multiple containerd packages: security update to 2.3.2-r0

critical Tenable Cloud Security Plugin ID 443745

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2,
 contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS)
 condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of
 Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can
 disrupt clients such as the Docker Engine or Kubernetes control-plane components. This issue has been
 fixed in versions 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2. (CVE-2026-47262)

 - containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a
 vulnerability in the CRI checkpoint import process where it fails to validate the image references
 specified within a checkpoint image's configuration. An attacker with permissions to create pods can use a
 crafted checkpoint image to force containerd to pull a malicious image and assign it an arbitrary local
 tag, thereby poisoning the node's local image cache. Subsequently, if other pods on the same node attempt
 to use the poisoned tag with an IfNotPresent (or Never) pull policy, they will unknowingly execute the
 attacker's malicious image instead of the legitimate one. This can lead to a compromise of the affected
 pods, allowing the attacker to execute arbitrary code under the victim pod's identity. This issue has been
 fixed in versions 2.3.2, 2.2.5 and 2.1.9. (CVE-2026-50195)

 - containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and
 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a
 container without validation. This may result in executing an arbitrary command on the host, via a plugin
 that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2,
 2.2.5, 2.1.9, and 2.0.10. (CVE-2026-53488)

 - containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug
 where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path.
 This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in
 versions 2.3.2, 2.2.5 and 2.1.9. (CVE-2026-53489)

 - containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI
 implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted
 checkpoint image metadata during container restoration. When restoring a container from a checkpoint,
 containerd preserves CDI-related annotations from the checkpoint archive rather than relying solely on the
 pod's create-time specification. This allows a user with pod creation permissions to bypass standard
 Kubernetes resource allocation and device plugin enforcement, injecting arbitrary CDI edits (such as
 device nodes and host mounts) into the restored container. Successful exploitation requires that the node
 has CDI enabled and contains a matching host CDI specification for the requested device; environments
 where CDI is disabled or lacking sensitive device specifications are not affected. This issue has been
 fixed in versions 2.3.2, 2.2.5 and 2.1.9. (CVE-2026-53492)

Solution

Update the containerd library and its related packages to version 2.3.2-r0 or later.

See Also

https://security.alpinelinux.org/vuln/CVE-2026-47262

https://security.alpinelinux.org/vuln/CVE-2026-50195

https://security.alpinelinux.org/vuln/CVE-2026-53488

https://security.alpinelinux.org/vuln/CVE-2026-53489

https://security.alpinelinux.org/vuln/CVE-2026-53492

Plugin Details

Severity: Critical

ID: 443745

Version: Revision 1.4

Type: Local

Published: 6/20/2026

Updated: 7/6/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7

Percentile: 98.27

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-53488

CVSS v3

Risk Factor: Critical

Base Score: 9.9

Temporal Score: 8.6

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-50195

CVSS v4

Risk Factor: Critical

Base Score: 9.4

Threat Score: 7.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/19/2026

Reference Information

CVE: CVE-2026-47262, CVE-2026-50195, CVE-2026-53488, CVE-2026-53489, CVE-2026-53492