Executive brief
containerd is a widely used tool for managing and running software containers in cloud environments like Kubernetes. A security flaw allows users with basic permissions to bypass safety checks when restoring a container from a saved state (checkpoint). This could allow an attacker to gain unauthorized access to sensitive hardware devices or host files, potentially compromising the security of the entire server.
Technical details
The vulnerability exists in containerd's Container Runtime Interface (CRI) implementation during the restoration of containers from checkpoints. The root cause is that containerd preserves CDI-related annotations from untrusted checkpoint archive metadata instead of strictly adhering to the pod's original create-time specification. An attacker with pod creation permissions can use this to perform 'annotation smuggling,' injecting arbitrary CDI edits such as unauthorized device nodes and host mounts. This bypasses standard Kubernetes resource allocation and device plugin enforcement. Exploitation requires the node to have CDI enabled and contain matching host CDI specifications; it is fixed in versions 2.3.2, 2.2.5, and 2.1.9.
Affected products
- containerd containerd >= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.5; >= 2.3.0, < 2.3.2
Timeline
- 2026-06-18: advisory: GitHub Security Advisory published
- 2026-07-01: disclosed: NVD publication date