CVE-2026-53489CWE-61

containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore

High · published July 1, 2026

CVSS v4.0
8.2
EPSS
0%
Percentile
6.6
In the wild
Unconfirmed
What it is

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00174 · 6.6th percentile
Weakness
CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2026-07-01T18:10Z
EPSS history
Timeline
  • 01 JUL 18:10Z
    containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore
    cvelistv5