Executive brief
containerd is a widely used tool for managing and running software containers, often used within Kubernetes environments. A flaw in how it handles user identification allows specially crafted container images to bypass security settings that are supposed to prevent software from running with administrative (root) privileges. If exploited, an attacker could run a container with full system access, potentially compromising the underlying host or accessing sensitive data.
Technical details
A vulnerability exists in containerd's handling of the 'User' directive where numeric strings that exceed the capacity of a 32-bit integer are incorrectly parsed as usernames rather than UIDs. An attacker can exploit this by creating a malicious container image with a large numeric User directive and a corresponding entry in /etc/passwd that maps that string to the root user (UID 0). This results in a 'runAsNonRoot' evasion, allowing the container to execute with elevated privileges despite security policies. The issue is reachable via local image import or deployment of untrusted images and has been patched in versions 1.7.32, 2.0.9, 2.2.4, and 2.3.1.
Affected products
- containerd containerd < 1.7.32, >= 2.0.4 < 2.0.9, >= 2.0.10 < 2.2.4, >= 2.2.5 < 2.3.1
Timeline
- 2026-05-20: advisory: Initial GitHub advisory published
- 2026-07-01: disclosed: NVD publication date