Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
containerd may skip source address check for certain callbacks
published 18 days ago
Summary
The containerd software can fail to verify the origin of a connection when a callback other than a public‑key is used. This could let an attacker bypass normal access checks and interact with the system. Update containerd to the latest version that includes the fix.
What to do
- Update cleanstart containerd to version 2.1.3-r3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | containerd |
< 2.1.3-r3 Fix: upgrade to 2.1.3-r3
|
Original advisory text
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...
Security vulnerability affects the containerd package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published30 Sep 2026
Updated8 Oct 2026
First seen8 Oct 2026
Sources
CLEANSTART-2026-TD03320 · OSV
Track software like this
Free during beta