Skip to content
VulniPulse
Sign in
Advisory severityMedium6.7Red Hat Linux

Medium [CVE-2026-50195] Arbitrary code execution via CRI checkpoint image tag poisoning

This medium-severity Red Hat Linux advisory covers CVE-2026-50195 affecting Red Hat Hardened Images.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-50195 Source published Source updated

VulniPulse record published Record updated

CVE-2026-50195
Affected products & platforms
Red Hat LinuxUnclassified
Open source advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's configuration.

An attacker with permissions to create pods can use a crafted checkpoint image to force containerd to pull a malicious image and assign it an arbitrary local tag, thereby poisoning the node's local image cache.

Subsequently, if other pods on the same node attempt to use the poisoned tag with an IfNotPresent (or Never) pull policy, they will unknowingly execute the attacker's malicious image instead of the legitimate one. This can lead to a compromise of the affected pods, allowing the attacker to execute arbitrary code under the victim pod's identity.

This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9. Red Hat products include the containerd Go module (v1.x) as a library dependency.

Red Hat severity: Moderate — CVSS 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-1289.

Affected Red Hat products: Red Hat Hardened Images.

Affected versions
  • < 2.3.2
  • < 2.2.5
  • < 2.1.9

Official advisory · high-confidence parse· fetched 23 days ago·verify at source

Fixed versions
  • 2.3.2
  • 2.2.5
  • 2.1.9
  • trivy-main-0.72.0-0.1.hum1
  • RHSA-2026:35111

Official advisory · high-confidence parse· fetched 23 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • No mitigation is needed as the vulnerable code is not present in the containerd versions shipped in Red Hat products.

Official advisory · high-confidence parse· fetched 23 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.