Skip to content
VulniPulse
Sign in
Highest advisory severityCritical 2 vendors · 2 advisories

CVE-2026-53488

CVE-2026-53488: 2 tracked advisory records across Docker, Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Docker

1 advisory
  • Advisory severityCritical9.4

    Critical [CVE-2026-53488] containerd is an open-source container runtime

    CVE-2026-53488Source published Source updated

    containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.

    Related products — impact not confirmed
    • containerd
    Source-reported affected versions
    • before 1.7.33
    Source-reported fixed versions
    • 1.7.33
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityHigh8.8

    High [CVE-2026-53488] Host-root command execution via unvalidated image config labels in CRI plugin

    CVE-2026-53488Source published Source updated

    containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10. The Container Runtime Interface (CRI) plugin, which manages container operations, fails to validate labels propagated from an image configuration to a container. This oversight could enable an attacker to execute arbitrary commands on the host system through a plugin that processes these unvalidated labels. The primary impact is host-root command execution…

    Affected products in this advisory
    • multicluster engine for Kubernetes 2.10
    • multicluster engine for Kubernetes 2.6
    • Multicluster Global Hub 1.4.9
    • Multicluster Global Hub 1.5.8

    42 more entries in the full advisory.

    Source-reported affected versions
    • < 1.7.33
    • < 2.3.2
    • < 2.2.5
    • < 2.1.9

    1 more entries in the full advisory.

    Source-reported fixed versions
    • 1.7.33
    • 2.3.2
    • 2.2.5
    • 2.1.9

    46 more entries in the full advisory.

    Mitigation guidance
    • Restrict container image pulls to trusted registries using admission policies or image signature verification. Where containerd is used as the container runtime, disable or restrict the binary:// logger URI scheme in the containerd configuration to prevent the label-to-logger attack path.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features