containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade containerd-stressUpgrade containerd-debuginfoUpgrade containerd | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade containerd-debuginfoUpgrade containerdUpgrade containerd-stressUpgrade containerd-stress-debuginfoUpgrade containerd-debugsource | Dec 9, 2025 | Nov 6, 2025 |
| Debian | — | Upgrade containerd | Dec 4, 2025 | Dec 4, 2025 |
| Dell Powerstore Dsa2026115 | — | Upgrade Dell PowerStoreOS to the latest version | Feb 25, 2026 | Feb 24, 2026 |
| Huawei Euleros 2_0_sp10 | — | Upgrade docker-engine-selinuxUpgrade docker-engine | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade docker-engine-selinuxUpgrade docker-engine | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade docker-engineUpgrade docker-engine-selinux | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade docker-engine-selinuxUpgrade docker-engine | Mar 10, 2026 | Mar 10, 2026 |
| Suse | — | Upgrade containerd-develUpgrade containerd-ctrUpgrade containerd | Dec 5, 2025 | Nov 12, 2025 |
| Ubuntu | — | Upgrade golang-github-containerd-containerd-devUpgrade golang-github-docker-containerd-dev (Ubuntu Pro)Upgrade containerd (Ubuntu Pro)Upgrade containerdUpgrade golang-github-containerd-containerd-dev (Ubuntu Pro) | Jan 30, 2026 | Nov 6, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Nov 6, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub