tocsin

Go/github.com/containerd/containerd/v2 CVE-2026-53489: high, EPSS 0.17%

Arbitrary host CRI log file read via symlink following in CRI checkpoint restore

Action: Upgrade github.com/containerd/containerd/v2 to 2.1.9 or later.

go get github.com/containerd/containerd/v2@v2.1.9
go get github.com/containerd/containerd/v2@v2.2.5
go get github.com/containerd/containerd/v2@v2.3.2

Affected

introducedfixedlast affected
2.1.02.1.9-
2.2.02.2.5-
2.3.02.3.2-

Fixed versions

2.1.92.2.52.3.2

Sources

CVE-2026-53489 · published · modified · JSON