Vulnerability-Lookup

CVE-2026-53489 (GCVE-0-2026-53489)

Vulnerability from cvelistv5 – Published: 2026-07-01 18:10 – Updated: 2026-07-02 14:34

Title

containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore

Summary

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-02 14:34 UTC

CWE

CWE-61 - UNIX Symbolic Link (Symlink) Following

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/containerd/containerd/security…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version	CPE status
containerd	containerd	Affected: >= 2.1.0, < 2.1.9 Affected: >= 2.2.0, < 2.2.5 Affected: >= 2.3.0, < 2.3.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53489",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-02T14:34:14.152419Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-02T14:34:50.018Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "containerd",
          "vendor": "containerd",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.1.0, \u003c 2.1.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.2.0, \u003c 2.2.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.3.0, \u003c 2.3.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-61",
              "description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-01T18:10:41.802Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388"
        }
      ],
      "source": {
        "advisory": "GHSA-rgh6-rfwx-v388",
        "discovery": "UNKNOWN"
      },
      "title": "containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-53489",
    "datePublished": "2026-07-01T18:10:41.802Z",
    "dateReserved": "2026-06-09T17:05:25.059Z",
    "dateUpdated": "2026-07-02T14:34:50.018Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53489",
      "date": "2026-09-19",
      "epss": "0.00174",
      "percentile": "0.07198"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "containerd",
                "vendor": "containerd",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 2.1.0, \u003c 2.1.9"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.2.0, \u003c 2.2.5"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.3.0, \u003c 2.3.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A83AFFD7-0DA1-43A4-88AC-2E56305B70D1",
                    "versionEndExcluding": "2.1.9",
                    "versionStartIncluding": "2.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B62A9FED-C400-4641-AE8B-AE7594307011",
                    "versionEndExcluding": "2.2.5",
                    "versionStartIncluding": "2.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B45FCE68-7923-499A-9059-1483851FCADE",
                    "versionEndExcluding": "2.3.2",
                    "versionStartIncluding": "2.3.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9."
          }
        ],
        "id": "CVE-2026-53489",
        "lastModified": "2026-07-02T19:33:12.850",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 4.0,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-53489",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-02T14:34:14.152419Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-01T19:16:54.383",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-61"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-18T07:37:20+00:00",
      "cve": "CVE-2026-53489",
      "id": "CVE-2026-53489",
      "initial_release_date": "2026-07-01T18:10:41.802000+00:00",
      "product_status:fixed": "175",
      "product_status:known_affected": "16",
      "product_status:known_not_affected": "216",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "github.com/containerd/containerd: containerd: Arbitrary host file read via symlink following in CRI checkpoint restore",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53489.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T16:41:10Z",
      "cve": "CVE-2026-53489",
      "id": "CVE-2026-53489",
      "initial_release_date": "2026-06-23T02:20:06Z",
      "product_status:known_affected": "103",
      "product_status:recommended": "3",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-53489",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-53489.json",
      "version": "7"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-53489",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-02T14:34:14.152419Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-02T14:34:45.686Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "containerd",
              "vendor": "containerd",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 2.1.0, \u003c 2.1.9"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.2.0, \u003c 2.2.5"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.3.0, \u003c 2.3.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "NONE"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-61",
                  "description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-01T18:10:41.802Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388"
            }
          ],
          "source": {
            "advisory": "GHSA-rgh6-rfwx-v388",
            "discovery": "UNKNOWN"
          },
          "title": "containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-53489",
        "datePublished": "2026-07-01T18:10:41.802Z",
        "dateReserved": "2026-06-09T17:05:25.059Z",
        "dateUpdated": "2026-07-02T14:34:50.018Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CLEANSTART-2026-VB09315 (CVE-2026-33186)

Vulnerability from cleanstart – Published: 2026-09-01 11:17 – Updated: 2026-09-18 11:59 – Source website

Withdrawn 2026-09-18

Summary

Security fixes in rancher-fleet-agent 0.12.17-r1

Details

Package rancher-fleet-agent version 0.12.17-r1 fixes 40 vulnerabilities: CVE-2026-33186, ghsa-hrxh-6v49-42gf, CVE-2026-46680, CVE-2026-53488, CVE-2026-47262...

References

URL

Type

https://github.com/rancher/fleet

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "rancher-fleet-agent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.12.17-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.12.17-r1"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package rancher-fleet-agent version 0.12.17-r1 fixes 40 vulnerabilities: CVE-2026-33186, ghsa-hrxh-6v49-42gf, CVE-2026-46680, CVE-2026-53488, CVE-2026-47262...",
  "id": "CLEANSTART-2026-VB09315",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-09-01T11:17:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rancher/fleet"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in rancher-fleet-agent 0.12.17-r1",
  "upstream": [
    "CVE-2026-33186",
    "ghsa-hrxh-6v49-42gf",
    "CVE-2026-46680",
    "CVE-2026-53488",
    "CVE-2026-47262",
    "CVE-2026-50195",
    "CVE-2026-53492",
    "CVE-2026-53489",
    "CVE-2026-39835",
    "CVE-2026-39828",
    "CVE-2026-39829",
    "CVE-2026-46597",
    "CVE-2026-39830",
    "CVE-2026-39831",
    "CVE-2026-39832",
    "CVE-2026-39833",
    "CVE-2026-39834",
    "CVE-2026-42508",
    "CVE-2026-46595",
    "CVE-2026-46598",
    "CVE-2026-39827",
    "CVE-2026-25681",
    "CVE-2026-27136",
    "CVE-2026-39821",
    "CVE-2026-42502",
    "CVE-2026-42506",
    "CVE-2026-25680",
    "CVE-2026-33814",
    "CVE-2026-46600",
    "CVE-2026-29181",
    "CVE-2026-35469",
    "CVE-2026-56852",
    "CVE-2026-50163",
    "CVE-2026-50151",
    "CVE-2026-50162",
    "ghsa-vh4v-2xq2-g5cg",
    "CVE-2026-48978",
    "CVE-2026-35206",
    "ghsa-259r-337f-4rfw",
    "CVE-2026-39824"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

CLEANSTART-2026-XT48985 (CVE-2026-50195)

Vulnerability from cleanstart – Published: 2026-09-01 11:17 – Updated: 2026-09-18 11:59 – Source website

Withdrawn 2026-09-18

Summary

Security fixes in rancher-agent 2.12.11-r1

Details

Package rancher-agent version 2.12.11-r1 fixes 18 vulnerabilities: CVE-2026-50195, CVE-2026-53492, CVE-2026-53489, CVE-2026-46680, CVE-2026-53488...

References

URL

Type

https://github.com/rancher/rancher

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "rancher-agent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.12.11-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.12.11-r1"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package rancher-agent version 2.12.11-r1 fixes 18 vulnerabilities: CVE-2026-50195, CVE-2026-53492, CVE-2026-53489, CVE-2026-46680, CVE-2026-53488...",
  "id": "CLEANSTART-2026-XT48985",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-09-01T11:17:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rancher/rancher"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in rancher-agent 2.12.11-r1",
  "upstream": [
    "CVE-2026-50195",
    "CVE-2026-53492",
    "CVE-2026-53489",
    "CVE-2026-46680",
    "CVE-2026-53488",
    "CVE-2026-47262",
    "ghsa-hrxh-6v49-42gf",
    "CVE-2026-56864",
    "CVE-2026-56865",
    "CVE-2026-56852",
    "CVE-2026-50163",
    "CVE-2026-48978",
    "CVE-2026-50151",
    "CVE-2026-50162",
    "ghsa-vh4v-2xq2-g5cg",
    "ghsa-gcjh-h69q-9w9g",
    "CVE-2026-41178",
    "ghsa-259r-337f-4rfw"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

CLEANSTART-2026-XV71690 (CVE-2026-53492)

Vulnerability from cleanstart – Published: 2026-09-01 11:17 – Updated: 2026-09-18 11:59 – Source website

Withdrawn 2026-09-18

Summary

Security fixes in rancher-fleet-agent 0.14.8-r1

Details

Package rancher-fleet-agent version 0.14.8-r1 fixes 39 vulnerabilities: CVE-2026-53492, CVE-2026-50195, CVE-2026-53489, CVE-2026-46680, CVE-2026-53488...

References

URL

Type

https://github.com/rancher/fleet

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "rancher-fleet-agent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.14.8-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.14.8-r1"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package rancher-fleet-agent version 0.14.8-r1 fixes 39 vulnerabilities: CVE-2026-53492, CVE-2026-50195, CVE-2026-53489, CVE-2026-46680, CVE-2026-53488...",
  "id": "CLEANSTART-2026-XV71690",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-09-01T11:17:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rancher/fleet"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in rancher-fleet-agent 0.14.8-r1",
  "upstream": [
    "CVE-2026-53492",
    "CVE-2026-50195",
    "CVE-2026-53489",
    "CVE-2026-46680",
    "CVE-2026-53488",
    "CVE-2026-47262",
    "CVE-2026-42508",
    "CVE-2026-39835",
    "CVE-2026-46598",
    "CVE-2026-39828",
    "CVE-2026-39829",
    "CVE-2026-46597",
    "CVE-2026-39830",
    "CVE-2026-39831",
    "CVE-2026-39832",
    "CVE-2026-39833",
    "CVE-2026-39834",
    "CVE-2026-46595",
    "CVE-2026-39827",
    "CVE-2026-33186",
    "ghsa-hrxh-6v49-42gf",
    "CVE-2026-46600",
    "CVE-2026-25681",
    "CVE-2026-27136",
    "CVE-2026-39821",
    "CVE-2026-42502",
    "CVE-2026-42506",
    "CVE-2026-25680",
    "CVE-2026-29181",
    "CVE-2026-35469",
    "CVE-2026-56852",
    "CVE-2026-50163",
    "CVE-2026-48978",
    "CVE-2026-50151",
    "CVE-2026-50162",
    "ghsa-vh4v-2xq2-g5cg",
    "CVE-2026-39824",
    "CVE-2026-35206",
    "ghsa-259r-337f-4rfw"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

CLEANSTART-2026-ZU67009 (CVE-2026-53492)

Vulnerability from cleanstart – Published: 2026-09-01 11:17 – Updated: 2026-09-18 11:59 – Source website

Withdrawn 2026-09-18

Summary

Security fixes in rancher-agent 2.14.3-r0

Details

Package rancher-agent version 2.14.3-r0 fixes 17 vulnerabilities: CVE-2026-53492, CVE-2026-50195, CVE-2026-46680, CVE-2026-53488, ghsa-hrxh-6v49-42gf...

References

URL

Type

https://github.com/rancher/rancher

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "rancher-agent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.14.3-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.14.3-r0"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package rancher-agent version 2.14.3-r0 fixes 17 vulnerabilities: CVE-2026-53492, CVE-2026-50195, CVE-2026-46680, CVE-2026-53488, ghsa-hrxh-6v49-42gf...",
  "id": "CLEANSTART-2026-ZU67009",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-09-01T11:17:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rancher/rancher"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in rancher-agent 2.14.3-r0",
  "upstream": [
    "CVE-2026-53492",
    "CVE-2026-50195",
    "CVE-2026-46680",
    "CVE-2026-53488",
    "ghsa-hrxh-6v49-42gf",
    "CVE-2026-56864",
    "CVE-2026-56865",
    "CVE-2026-48978",
    "CVE-2026-50163",
    "CVE-2026-50151",
    "CVE-2026-53489",
    "ghsa-gcjh-h69q-9w9g",
    "CVE-2026-47262",
    "CVE-2026-41178",
    "CVE-2026-50162",
    "ghsa-vh4v-2xq2-g5cg",
    "ghsa-259r-337f-4rfw"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

FKIE_CVE-2026-53489

Vulnerability from fkie_nvd - Published: 2026-07-01 19:16 - Updated: 2026-07-02 19:33

Severity

6.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388	Mitigation, Vendor Advisory

Impacted products

Vendor	Product	Version
linuxfoundation	containerd	*
linuxfoundation	containerd	*
linuxfoundation	containerd	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "containerd",
          "vendor": "containerd",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.1.0, \u003c 2.1.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.2.0, \u003c 2.2.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.3.0, \u003c 2.3.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A83AFFD7-0DA1-43A4-88AC-2E56305B70D1",
              "versionEndExcluding": "2.1.9",
              "versionStartIncluding": "2.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B62A9FED-C400-4641-AE8B-AE7594307011",
              "versionEndExcluding": "2.2.5",
              "versionStartIncluding": "2.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B45FCE68-7923-499A-9059-1483851FCADE",
              "versionEndExcluding": "2.3.2",
              "versionStartIncluding": "2.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9."
    }
  ],
  "id": "CVE-2026-53489",
  "lastModified": "2026-07-02T19:33:12.850",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 4.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-53489",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-02T14:34:14.152419Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-01T19:16:54.383",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-61"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-RGH6-RFWX-V388

Vulnerability from github – Published: 2026-06-19 19:35 – Updated: 2026-06-19 19:35

Summary

Arbitrary host CRI log file read via symlink following in CRI checkpoint restore

Details

Impact

A bug was found in containerd where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs.

Patches

This bug has been fixed in the following containerd versions:

2.3.2
2.2.5
2.1.9

Users should update to these versions to resolve the issue.

Workarounds

Ensure that only trusted images and checkpoints are used.

Credits

The containerd project would like to thank @gouldnicholas and @davidrxchester, Yuming Zhang and Song Li of Zhejiang University, Sangwon Ryu (@sangwon090), Henry Beberman (@hbeberman) of Microsoft, the GKE Security Team using Gemini, Anthropic Research, in collaboration with Claude, Robert Prast (@robertprast), Kyle Elliott (@kyle-elliott-tob) of Trail of Bits, and Zhenchen Wang (@Plucky923), who independently discovered and responsibly disclosed this issue in accordance with the containerd security policy.

For more information

If you have any questions or comments about this advisory:

Open an issue in containerd
Email us at security@containerd.io

To report a security issue in containerd: * Report a new vulnerability * Email us at security@containerd.io

Severity

7.1 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/containerd/containerd/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.1.0"
            },
            {
              "fixed": "2.1.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/containerd/containerd/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.2.0"
            },
            {
              "fixed": "2.2.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/containerd/containerd/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.3.0"
            },
            {
              "fixed": "2.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53489"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-61"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T19:35:36Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\nA bug was found in containerd where the CRI plugin restores `container.log` from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via `kubectl logs`.\n\n### Patches\nThis bug has been fixed in the following containerd versions:\n\n* 2.3.2\n* 2.2.5\n* 2.1.9\n\nUsers should update to these versions to resolve the issue.\n\n### Workarounds\nEnsure that only trusted images and checkpoints are used.\n\n### Credits\nThe containerd project would like to thank @gouldnicholas and @davidrxchester, Yuming Zhang and Song Li of Zhejiang University, Sangwon Ryu (@sangwon090), Henry Beberman (@hbeberman) of Microsoft, the GKE Security Team using Gemini, Anthropic Research, in collaboration with Claude, Robert Prast (@robertprast),\nKyle Elliott (@kyle-elliott-tob) of Trail of Bits, and Zhenchen Wang (@Plucky923), who independently discovered and responsibly disclosed this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md).\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n* [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new)\n* Email us at [security@containerd.io](mailto:security@containerd.io)",
  "id": "GHSA-rgh6-rfwx-v388",
  "modified": "2026-06-19T19:35:36Z",
  "published": "2026-06-19T19:35:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/containerd/containerd"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Arbitrary host CRI log file read via symlink following in CRI checkpoint restore"
}

OPENSUSE-SU-2026:11102-1

Vulnerability from csaf_opensuse - Published: 2026-06-22 00:00 - Updated: 2026-09-17 17:11

Summary

trivy-0.71.2-1.1 on GA media

Severity

Moderate

Scope

5 vulnerabilities in this advisory, including CVE-2026-53489.

CVE-2026-53489

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Recommended: 4 products

Open the full advisory

OPENSUSE-SU-2026:21072-1

Vulnerability from csaf_opensuse - Published: 2026-06-26 09:25 - Updated: 2026-09-17 17:36

Summary

Security update for trivy

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2026-53489.

CVE-2026-53489

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Recommended: 4 products

Open the full advisory

RHSA-2026:15862

Vulnerability from csaf_redhat - Published: 2026-05-09 15:24 - Updated: 2026-09-18 08:01

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Critical

Scope

5 vulnerabilities in this advisory, including CVE-2026-53489.

CVE-2026-53489

A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) plugin incorrectly restores container logs from a checkpoint image. This vulnerability, categorized as a Path Traversal (CWE-61), allows an attacker to read arbitrary files on the host system by manipulating symlinked paths during the checkpoint restore process. This can lead to unauthorized information disclosure from the host.

6.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Fixed: 3 products

https://access.redhat.com/errata/RHSA-2026:15862

Open the full advisory

RHSA-2026:32963

Vulnerability from csaf_redhat - Published: 2026-06-29 09:13 - Updated: 2026-09-18 08:01

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2026-53489.

CVE-2026-53489

6.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Fixed: 3 products

https://access.redhat.com/errata/RHSA-2026:32963

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-53489 (GCVE-0-2026-53489)

CLEANSTART-2026-VB09315 (CVE-2026-33186)

CLEANSTART-2026-XT48985 (CVE-2026-50195)

CLEANSTART-2026-XV71690 (CVE-2026-53492)

CLEANSTART-2026-ZU67009 (CVE-2026-53492)

FKIE_CVE-2026-53489

GHSA-RGH6-RFWX-V388

Impact

Patches

Workarounds

Credits

For more information

OPENSUSE-SU-2026:11102-1

OPENSUSE-SU-2026:21072-1

RHSA-2026:15862

RHSA-2026:32963

Tags

Sightings

Nomenclature

Related by attack behaviour