Affected: Alpaquita:25: containerd, Alpaquita:stream: containerd

Withdrawn by the publisher.

Affected: CleanStart: rancher-fleet-agent

Package rancher-fleet-agent version 0.13.13-r1 fixes 34 vulnerabilities: CVE-2026-50195, CVE-2026-53492, CVE-2026-46680, CVE-2026-53488, CVE-2026-53489...

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can use a crafted checkpoint image to force containerd to pull a malicious image and assign it an arbitrary local tag, thereby poisoning the node's local image cache. Subsequently, if other pods on the same node attempt to use the poisoned tag with an IfNotPresent (or Never) pull policy, they will unknowingly execute the attacker's malicious image instead of the legitimate one. This can lead to a compromise of the affected pods, allowing the attacker to execute arbitrary code under the victim pod's identity. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.

Affected: Go: github.com/containerd/containerd/v2

## Impact containerd's CRI checkpoint import process contains a vulnerability where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can use a crafted checkpoint image to force containerd to pull a malicious image and assign it an arbitrary local tag, thereby poisoning the node's local image cache. Subsequently, if other pods on the same node attempt to use the poisoned tag with an `IfNotPresent` (or `Never`) pull policy, they will unknowingly execute the attacker's malicious image instead of the legitimate one. This can lead to a compromise of the affected pods, allowing the attacker to execute arbitrary code under the victim pod's identity.

## Patches This bug has been fixed in the following containerd versions:

* 2.3.2 * 2.2.5 * 2.1.9

Users should update to these versions to resolve the issue. ## Workarounds Users should only allow trusted images to be pulled.

## Credits The containerd project would like to thank Henry Beberman (@hbeberman) of Microsoft, the GKE Security Team using Gemini, Anthropic Research, in collaboration with Claude, and Robert Prast (@robertprast) who independently discovered and responsibly disclosed this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md).

## For more information If you have any questions or comments about this advisory:

* Open an issue in [containerd](https://github.com…

trivy-0.71.2-1.1 on GA media

github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input golang: github.com/go-git/go-git: go-git: Information disclosure of HTTP authentication credentials via redirects github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation github.com/containerd/containerd: containerd: Privilege escalation via incorrect user ID handling github.com/containerd/containerd: containerd: Denial of Service via maliciously crafted image leading to unbounded group parsing github.com/sigstore/rekor: Rekor: Denial of Service due to unbounded gzip decompression in Alpine APK parsing github.com/containerd/containerd: containerd: Arbitrary code execution via CRI checkpoint image tag poisoning github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin

Affected: Ubuntu:22.04:LTS: containerd-app, Ubuntu:24.04:LTS: containerd-app, Ubuntu:25.10: containerd-app, Ubuntu:25.10: containerd-stable, Ubuntu:26.04:LTS: containerd-app, Ubuntu:26.04:LTS: containerd-stable

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can use a crafted checkpoint image to force containerd to pull a malicious image and assign it an arbitrary local tag, thereby poisoning the node's local image cache. Subsequently, if other pods on the same node attempt to use the poisoned tag with an IfNotPresent (or Never) pull policy, they will unknowingly execute the attacker's malicious image instead of the legitimate one. This can lead to a compromise of the affected pods, allowing the attacker to execute arbitrary code under the victim pod's identity. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Google Cloud Platform ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.