CVE-2026-53488

Name of the Vulnerable Software and Affected Versions containerd versions prior to 2.3.2 containerd versions prior to 2.2.5 containerd versions prior to 2.1.9 containerd versions prior to 2.0.10 containerd versions prior to 1.7.33

Description A bug in the CRI plugin allows the propagation of labels from an image config, specifically the LABEL instruction in a Dockerfile, to a container without proper validation. This can lead to the execution of arbitrary commands on the host system if a plugin that consumes container labels for its operations is used.

Recommendations Update to version 2.3.2 Update to version 2.2.5 Update to version 2.1.9 Update to version 2.0.10 Update to version 1.7.33 Ensure that only trusted images are used.