UBUNTU-CVE-2026-53489

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-53489
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-53489.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2026-53489
Upstream
Downstream
Related
Published
2026-06-22T00:00:00Z
Modified
2026-07-09T17:16:06.436840712Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
  • Ubuntu - high
Summary
[none]
Details

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.

References

Affected packages

Ubuntu:22.04:LTS
containerd-app

Package

Name
containerd-app
Purl
pkg:deb/ubuntu/containerd-app?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.2.1-0ubuntu1~22.04.2

Affected versions

1.*
1.7.2-0ubuntu1~22.04.1
1.7.12-0ubuntu2~22.04.1
1.7.24-0ubuntu1~22.04.1
1.7.24-0ubuntu1~22.04.2
1.7.27-0ubuntu1~22.04.1
1.7.28-0ubuntu1~22.04.1
2.*
2.2.1-0ubuntu1~22.04.1

Ecosystem specific 

{
    "priority_reason": "High severity",
    "binaries": [
        {
            "binary_name": "containerd",
            "binary_version": "2.2.1-0ubuntu1~22.04.2"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-53489.json"
Ubuntu:24.04:LTS
containerd-app

Package

Name
containerd-app
Purl
pkg:deb/ubuntu/containerd-app?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.2.1-0ubuntu1~24.04.3

Affected versions

1.*
1.7.2-0ubuntu2
1.7.12-0ubuntu1
1.7.12-0ubuntu2
1.7.12-0ubuntu3
1.7.12-0ubuntu4
1.7.12-0ubuntu4.1
1.7.19-0ubuntu1~24.04.1
1.7.19+really1.7.12-0ubuntu4.2
1.7.24-0ubuntu1~24.04.1
1.7.24-0ubuntu1~24.04.2
1.7.27-0ubuntu1~24.04.1
1.7.28-0ubuntu1~24.04.1
1.7.28-0ubuntu1~24.04.2
2.*
2.2.1-0ubuntu1~24.04.2

Ecosystem specific 

{
    "priority_reason": "High severity",
    "binaries": [
        {
            "binary_name": "containerd",
            "binary_version": "2.2.1-0ubuntu1~24.04.3"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-53489.json"
Ubuntu:25.10
containerd-app

Package

Name
containerd-app
Purl
pkg:deb/ubuntu/containerd-app?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.2.1-0ubuntu1~25.10.2

Affected versions

2.*
2.0.2-0ubuntu2
2.0.5-0ubuntu1
2.1.3-0ubuntu2
2.1.3-0ubuntu3
2.1.3-0ubuntu3.1
2.2.1-0ubuntu1~25.10.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "containerd",
            "binary_version": "2.2.1-0ubuntu1~25.10.2"
        }
    ],
    "priority_reason": "High severity",
    "availability": "No subscription required"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-53489.json"
containerd-stable

Package

Name
containerd-stable
Purl
pkg:deb/ubuntu/containerd-stable?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.1.6-0ubuntu1~25.10.2

Affected versions

2.*
2.1.3-0ubuntu1
2.1.6-0ubuntu1~25.10.1

Ecosystem specific 

{
    "priority_reason": "High severity",
    "binaries": [
        {
            "binary_name": "containerd-stable",
            "binary_version": "2.1.6-0ubuntu1~25.10.2"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-53489.json"
Ubuntu:26.04:LTS
containerd-app

Package

Name
containerd-app
Purl
pkg:deb/ubuntu/containerd-app?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.2.2-0ubuntu1.1

Affected versions

2.*
2.1.3-0ubuntu3
2.2.1-0ubuntu1
2.2.2-0ubuntu1

Ecosystem specific 

{
    "priority_reason": "High severity",
    "binaries": [
        {
            "binary_name": "containerd",
            "binary_version": "2.2.2-0ubuntu1.1"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-53489.json"
containerd-stable

Package

Name
containerd-stable
Purl
pkg:deb/ubuntu/containerd-stable?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.2.2-0ubuntu1.1

Affected versions

2.*
2.1.3-0ubuntu1
2.1.5-0ubuntu1
2.2.1-0ubuntu1
2.2.2-0ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "containerd-stable",
            "binary_version": "2.2.2-0ubuntu1.1"
        }
    ],
    "priority_reason": "High severity",
    "availability": "No subscription required"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-53489.json"