Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.6
CVE-2026-50195: containerd: Malicious images can be pulled by attackers
GHSA-cvxm-645q-p574
CVE-2026-50195
GHSA-cvxm-645q-p574
Summary
A bug in containerd allows attackers to pull malicious images and replace legitimate ones. This can lead to compromised pods and arbitrary code execution. To fix this, update to containerd versions 2.3.2, 2.2.5, or 2.1.9. Alternatively, only allow trusted images to be pulled.
What to do
- Update github.com containerd to version 2.1.9.
- Update github.com containerd to version 2.2.5.
- Update github.com containerd to version 2.3.2.
- Update containerd github.com/containerd/containerd/v2 to version 2.1.9.
- Update containerd github.com/containerd/containerd/v2 to version 2.2.5.
- Update containerd github.com/containerd/containerd/v2 to version 2.3.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | containerd |
>= 2.1.0, < 2.1.9 >= 2.2.0, < 2.2.5 >= 2.3.0, < 2.3.2 Fix: upgrade to 2.1.9
|
| Go | containerd | github.com/containerd/containerd/v2 |
>= 2.1.0, < 2.1.9 >= 2.2.0, < 2.2.5 >= 2.3.0, < 2.3.2 Fix: upgrade to 2.1.9
|
| – | linuxfoundation | containerd |
>= 2.1.0, < 2.1.9 >= 2.2.0, < 2.2.5 >= 2.3.0, < 2.3.2 cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* |
Original title
containerd: CRI checkpoint import allows local image tag poisoning
Original description
## Impact
containerd's CRI checkpoint import process contains a vulnerability where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can use a crafted checkpoint image to force containerd to pull a malicious image and assign it an arbitrary local tag, thereby poisoning the node's local image cache. Subsequently, if other pods on the same node attempt to use the poisoned tag with an `IfNotPresent` (or `Never`) pull policy, they will unknowingly execute the attacker's malicious image instead of the legitimate one. This can lead to a compromise of the affected pods, allowing the attacker to execute arbitrary code under the victim pod's identity.
## Patches
This bug has been fixed in the following containerd versions:
* 2.3.2
* 2.2.5
* 2.1.9
Users should update to these versions to resolve the issue.
## Workarounds
Users should only allow trusted images to be pulled.
## Credits
The containerd project would like to thank Henry Beberman (@hbeberman) of Microsoft, the GKE Security Team using Gemini, Anthropic Research, in collaboration with Claude, and Robert Prast (@robertprast) who independently discovered and responsibly disclosed this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md).
## For more information
If you have any questions or comments about this advisory:
* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)
* Email us at [[email protected]](mailto:[email protected])
To report a security issue in containerd:
* [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new)
* Email us at [[email protected]](mailto:[email protected])
containerd's CRI checkpoint import process contains a vulnerability where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can use a crafted checkpoint image to force containerd to pull a malicious image and assign it an arbitrary local tag, thereby poisoning the node's local image cache. Subsequently, if other pods on the same node attempt to use the poisoned tag with an `IfNotPresent` (or `Never`) pull policy, they will unknowingly execute the attacker's malicious image instead of the legitimate one. This can lead to a compromise of the affected pods, allowing the attacker to execute arbitrary code under the victim pod's identity.
## Patches
This bug has been fixed in the following containerd versions:
* 2.3.2
* 2.2.5
* 2.1.9
Users should update to these versions to resolve the issue.
## Workarounds
Users should only allow trusted images to be pulled.
## Credits
The containerd project would like to thank Henry Beberman (@hbeberman) of Microsoft, the GKE Security Team using Gemini, Anthropic Research, in collaboration with Claude, and Robert Prast (@robertprast) who independently discovered and responsibly disclosed this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md).
## For more information
If you have any questions or comments about this advisory:
* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)
* Email us at [[email protected]](mailto:[email protected])
To report a security issue in containerd:
* [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new)
* Email us at [[email protected]](mailto:[email protected])
ghsa CVSS4.0
5.6
Vulnerability type
CWE-345
CWE-829
Published: 19 Jun 2026 · Updated: 23 Jul 2026 · First seen: 19 Jun 2026