CVE-2026-53489

Medium [CVE-2026-53489] Arbitrary host file read via symlink following in CRI checkpoint restore

CVE-2026-53489Source published Jul 1, 2026Source updated Jul 1, 2026

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9. This vulnerability, categorized as a Path Traversal (CWE-61), allows an attacker to read arbitrary files on the host system by manipulating symlinked paths during the checkpoint restore process. This can lead to unauthorized information disclosure from the host. This vulnerability is not exploitable in several Red Hat products listed in the affect table. Although some shipped images include the containerd Go module (primarily v1.x, and in a few…

Affected products in this advisory

• Red Hat Hardened Images
• Red Hat Openshift Data Foundation 4.19
• Red Hat Openshift Data Foundation 4.20
• Exploit Intelligence

5 more entries in the full advisory.

Source-reported affected versions

• < 2.3.2
• < 2.2.5
• < 2.1.9

Source-reported fixed versions

• 2.3.2
• 2.2.5
• 2.1.9
• trivy-main-0.69.3-1.2.hum1

44 more entries in the full advisory.

Mitigation guidance

• For Red Hat OpenShift and layered products, CRI-O is the supported container runtime, so the vulnerable containerd CRI checkpoint-restore code path is not exercised during normal cluster operation. Customers should nevertheless apply Red Hat product errata as they become available to receive updates for affected operator, must-gather and tooling images that may bundle the containerd Go module. If containerd is deployed as the container runtime with CRI checkpoint/restore enabled, disable checkpoint/restore functionality until a fixed version of containerd can be applied.