{"id":"UBUNTU-CVE-2026-53489","details":"containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.","modified":"2026-07-09T17:16:06.436840712Z","published":"2026-06-22T00:00:00Z","related":["USN-8472-1","USN-8473-1"],"upstream":["CVE-2026-53489"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-53489"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-53489"},{"type":"REPORT","url":"https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8472-1"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8473-1"}],"affected":[{"package":{"name":"containerd-app","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/containerd-app?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-0ubuntu1~22.04.2"}]}],"versions":["1.7.2-0ubuntu1~22.04.1","1.7.12-0ubuntu2~22.04.1","1.7.24-0ubuntu1~22.04.1","1.7.24-0ubuntu1~22.04.2","1.7.27-0ubuntu1~22.04.1","1.7.28-0ubuntu1~22.04.1","2.2.1-0ubuntu1~22.04.1"],"ecosystem_specific":{"availability":"No subscription required","priority_reason":"High severity","binaries":[{"binary_name":"containerd","binary_version":"2.2.1-0ubuntu1~22.04.2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-53489.json"}},{"package":{"name":"containerd-app","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/containerd-app?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-0ubuntu1~24.04.3"}]}],"versions":["1.7.2-0ubuntu2","1.7.12-0ubuntu1","1.7.12-0ubuntu2","1.7.12-0ubuntu3","1.7.12-0ubuntu4","1.7.12-0ubuntu4.1","1.7.19-0ubuntu1~24.04.1","1.7.19+really1.7.12-0ubuntu4.2","1.7.24-0ubuntu1~24.04.1","1.7.24-0ubuntu1~24.04.2","1.7.27-0ubuntu1~24.04.1","1.7.28-0ubuntu1~24.04.1","1.7.28-0ubuntu1~24.04.2","2.2.1-0ubuntu1~24.04.2"],"ecosystem_specific":{"binaries":[{"binary_name":"containerd","binary_version":"2.2.1-0ubuntu1~24.04.3"}],"availability":"No subscription required","priority_reason":"High severity"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-53489.json"}},{"package":{"name":"containerd-app","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/containerd-app?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-0ubuntu1~25.10.2"}]}],"versions":["2.0.2-0ubuntu2","2.0.5-0ubuntu1","2.1.3-0ubuntu2","2.1.3-0ubuntu3","2.1.3-0ubuntu3.1","2.2.1-0ubuntu1~25.10.1"],"ecosystem_specific":{"availability":"No subscription required","priority_reason":"High severity","binaries":[{"binary_name":"containerd","binary_version":"2.2.1-0ubuntu1~25.10.2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-53489.json"}},{"package":{"name":"containerd-stable","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/containerd-stable?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.6-0ubuntu1~25.10.2"}]}],"versions":["2.1.3-0ubuntu1","2.1.6-0ubuntu1~25.10.1"],"ecosystem_specific":{"availability":"No subscription required","priority_reason":"High severity","binaries":[{"binary_name":"containerd-stable","binary_version":"2.1.6-0ubuntu1~25.10.2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-53489.json"}},{"package":{"name":"containerd-app","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/containerd-app?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-0ubuntu1.1"}]}],"versions":["2.1.3-0ubuntu3","2.2.1-0ubuntu1","2.2.2-0ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"containerd","binary_version":"2.2.2-0ubuntu1.1"}],"availability":"No subscription required","priority_reason":"High severity"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-53489.json"}},{"package":{"name":"containerd-stable","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/containerd-stable?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-0ubuntu1.1"}]}],"versions":["2.1.3-0ubuntu1","2.1.5-0ubuntu1","2.2.1-0ubuntu1","2.2.2-0ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"containerd-stable","binary_version":"2.2.2-0ubuntu1.1"}],"availability":"No subscription required","priority_reason":"High severity"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-53489.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"},{"type":"Ubuntu","score":"high"}]}