Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-01T17:40:25 github.com/containerd/containerd: containerd: Privilege escalation via incorrect user ID handling 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-681

containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the Kubernetes runAsNonRoot restriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user. This issue has been fixed in versions 1.7.32, 2.0.9, 2.2.4 and 2.3.1.

A flaw was found in containerd, an open-source container runtime. Containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username. This vulnerability allows a crafted container image to bypass the Kubernetes `runAsNonRoot` restriction, potentially leading to privilege escalation where the container runs as the root user (UID 0). This can cause unexpected behavior in environments designed to enforce non-root user execution.

Red Hat OpenShift Container Platform and its layered products include the containerd Go library as a build-time dependency for various components. These products do not use containerd as a container runtime; CRI-O is used instead. The vulnerable code path responsible for parsing User directives during container runtime spec generation is not exercised. Therefore, although the containerd library is present in shipped binaries, the vulnerability is not exploitable in the context of Red Hat products. Enforce a specific numeric runAsUser in the Kubernetes Pod securityContext, which overrides the User directive in the container image and prevents the bypass. Additionally, restrict access to push container images to trusted users only, and validate image provenance before deployment. Red Hat Hardened Images 2026-07-02T00:00:00Z RHSA-2026:35111 trivy-main-0.72.0-0.1.hum1 Assisted Installer for Red Hat OpenShift Container Platform 2 Not affected assisted/agent-preinstall-image-builder-rhel9 Assisted Installer for Red Hat OpenShift Container Platform 2 Not affected rhai/assisted-installer-agent-rhel9 Confidential Compute Attestation Not affected openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9 Confidential Compute Attestation Not affected openshift-sandboxed-containers/osc-monitor-rhel9 Confidential Compute Attestation Not affected openshift-sandboxed-containers/osc-must-gather-rhel9 Confidential Compute Attestation Not affected openshift-sandboxed-containers/osc-podvm-payload-rhel9 Deployment Validation Operator Not affected dvo/deployment-validation-rhel8-operator Gatekeeper 3 Not affected gatekeeper/gatekeeper-rhel9 Kernel Module Management Operator for Red Hat Openshift Not affected kmm/kernel-module-management-must-gather-rhel9 Logging Subsystem for Red Hat OpenShift Not affected openshift-logging/cluster-logging-rhel9-operator Logical Volume Manager Storage Not affected lvms4/lvms-must-gather-rhel9 Machine Deletion Remediation Operator Not affected workload-availability/machine-deletion-remediation-operator-bundle Machine Deletion Remediation Operator Not affected workload-availability/machine-deletion-remediation-rhel9-operator MCP Server for Red Hat OpenShift Not affected openshift-mcp-beta/openshift-mcp-server-rhel9 Migration Toolkit for Containers Not affected rhmtc/openshift-migration-log-reader-rhel8 Migration Toolkit for Containers Not affected rhmtc/openshift-migration-must-gather-rhel8 Migration Toolkit for Virtualization Not affected migration-toolkit-virtualization/mtv-must-gather-rhel8 Migration Toolkit for Virtualization Not affected migration-toolkit-virtualization/mtv-must-gather-rhel9 Migration Toolkit for Virtualization Not affected mtv-candidate/mtv-must-gather-rhel8 Multicluster Engine for Kubernetes Not affected multicluster-engine/assisted-installer-agent-rhel8 Multicluster Engine for Kubernetes Not affected multicluster-engine/assisted-installer-agent-rhel9 Multicluster Engine for Kubernetes Not affected multicluster-engine/assisted-installer-controller-rhel8 Multicluster Engine for Kubernetes Not affected multicluster-engine/assisted-installer-controller-rhel9 Multicluster Engine for Kubernetes Not affected multicluster-engine/assisted-installer-rhel8 Multicluster Engine for Kubernetes Not affected multicluster-engine/assisted-service-8-rhel8 Multicluster Engine for Kubernetes Not affected multicluster-engine/assisted-service-9-rhel9 Multicluster Engine for Kubernetes Not affected multicluster-engine/must-gather-rhel9 Multicluster Global Hub Not affected multicluster-globalhub/multicluster-globalhub-agent-rhel9 Multicluster Global Hub Not affected multicluster-globalhub/multicluster-globalhub-grafana-rhel9 Multicluster Global Hub Not affected multicluster-globalhub/multicluster-globalhub-manager-rhel9 Multicluster Global Hub Not affected multicluster-globalhub/multicluster-globalhub-rhel9-operator Node HealthCheck Operator Not affected workload-availability/node-healthcheck-must-gather-rhel9 OpenShift API for Data Protection Not affected oadp/oadp-mustgather-rhel9 OpenShift Developer Tools and Services Not affected ocp-tools-4/jenkins-agent-base-rhel8 OpenShift Developer Tools and Services Not affected ocp-tools-4/jenkins-agent-base-rhel9 OpenShift Developer Tools and Services Not affected ocp-tools-4/jenkins-rhel8 OpenShift Developer Tools and Services Not affected ocp-tools-4/jenkins-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed/lightspeed-agentic-sandbox-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed/openshift-mcp-server-rhel9 OpenShift Pipelines Not affected openshift-pipelines/pipelines-controller-rhel8 OpenShift Pipelines Not affected openshift-pipelines/pipelines-entrypoint-rhel8 OpenShift Pipelines Not affected openshift-pipelines/pipelines-results-watcher-rhel8 OpenShift Pipelines Not affected openshift-pipelines/pipelines-sidecarlogresults-rhel8 OpenShift Serverless Not affected openshift-serverless-1/serverless-must-gather-rhel9 OpenShift Service Mesh 2 Not affected openshift-service-mesh/istio-must-gather-rhel9 OpenShift Service Mesh 2 Not affected openshift-service-mesh/istio-rhel8-operator OpenShift Service Mesh 3 Not affected openshift-service-mesh/istio-must-gather-rhel9 OpenShift Service Mesh 3 Not affected openshift-service-mesh/istio-rhel9-operator Pen Drive Powered by Red Hat Lightspeed Not affected pen-drive/pen-drive-scanner-rhel9 Pen Drive Powered by Red Hat Lightspeed Not affected pen-drive/pen-drive-scanner-rhel9 Power monitoring for Red Hat OpenShift Not affected openshift-power-monitoring/power-monitoring-rhel9-operator Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/acm-grafana-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/acm-must-gather-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/multicloud-integrations-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/multiclusterhub-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/multicluster-operators-channel-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/multicluster-operators-subscription-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/submariner-operator-bundle Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/submariner-rhel9-operator Red Hat Advanced Cluster Security 4 Not affected advanced-cluster-security/rhacs-main-rhel8 Red Hat Advanced Cluster Security 4 Not affected advanced-cluster-security/rhacs-main-rhel9 Red Hat Advanced Cluster Security 4 Not affected advanced-cluster-security/rhacs-operator-bundle Red Hat Advanced Cluster Security 4 Not affected advanced-cluster-security/rhacs-rhel8-operator Red Hat Advanced Cluster Security 4 Not affected advanced-cluster-security/rhacs-rhel9-operator Red Hat Advanced Cluster Security 4 Not affected advanced-cluster-security/rhacs-roxctl-rhel8 Red Hat Advanced Cluster Security 4 Not affected advanced-cluster-security/rhacs-roxctl-rhel9 Red Hat Advanced Cluster Security 4 Not affected advanced-cluster-security/rhacs-scanner-v4-rhel8 Red Hat Advanced Cluster Security 4 Not affected advanced-cluster-security/rhacs-scanner-v4-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-24/aap-must-gather-rhel8 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-25/aap-must-gather-rhel8 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-26/aap-must-gather-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-27/aap-must-gather-rhel9 Red Hat Build of Kueue Not affected kueue/kueue-must-gather-rhel9 Red Hat Ceph Storage 6 Not affected rhceph/rhceph-promtail-rhel9 Red Hat Ceph Storage 9 Not affected rhceph/alloy-rhel10 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-must-gather-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-spark-operator-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/rhai-cli-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/cnf-tests-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/cnf-tests-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/container-networking-plugins-microshift-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4-dev-preview-beta/openperouter-edge-rhel10-operator Red Hat OpenShift Container Platform 4 Not affected openshift4-dev-preview-beta/openperouter-operator-bundle Red Hat OpenShift Container Platform 4 Not affected openshift4-dev-preview-beta/openperouter-rhel9-operator Red Hat OpenShift Container Platform 4 Not affected openshift4/kube-compare-artifacts-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/lifecycle-agent-rhel9-operator Red Hat OpenShift Container Platform 4 Not affected openshift4/metallb-rhel8-operator Red Hat OpenShift Container Platform 4 Not affected openshift4/metallb-rhel9-operator Red Hat OpenShift Container Platform 4 Not affected openshift4/network-tools-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/network-tools-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/numaresources-must-gather-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/numaresources-operator-bundle Red Hat OpenShift Container Platform 4 Not affected openshift4/numaresources-rhel9-operator Red Hat OpenShift Container Platform 4 Not affected openshift4/oc-mirror-plugin-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/oc-mirror-plugin-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-agent-installer-api-server-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-agent-installer-api-server-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-agent-installer-csr-approver-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-agent-installer-csr-approver-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-agent-installer-node-agent-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-agent-installer-orchestrator-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-agent-installer-orchestrator-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-ansible-operator Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-azure-cluster-api-controllers-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-cli Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-cli-artifacts Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-cli-artifacts-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-cli-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-cluster-ingress-rhel9-operator Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-cluster-kube-cluster-api-rhel8-operator Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-cluster-olm-rhel9-operator Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-console Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-console-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-container-networking-plugins-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-container-networking-plugins-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-csi-driver-shared-resource-mustgather-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-csi-driver-shared-resource-mustgather-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-deployer Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-deployer-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-docker-builder Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-docker-builder-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-docker-registry Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-helm-operator Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-helm-rhel9-operator Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-local-storage-mustgather-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-local-storage-mustgather-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-machine-os-images-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-must-gather Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-must-gather-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-node-feature-discovery Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-olm-catalogd-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-olm-catalogd-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-olm-operator-controller-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-olm-operator-controller-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-olm-rukpak-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-olm-rukpak-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-operator-framework-tools-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-operator-lifecycle-manager Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-operator-lifecycle-manager-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-operator-registry Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-operator-registry-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-operator-sdk-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-operator-sdk-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-ovn-kubernetes Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-sdn-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-secrets-store-csi-mustgather-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-secrets-store-csi-mustgather-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-tests Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-tests-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-tools-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-tools-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ptp-must-gather-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/ptp-must-gather-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ztp-site-generate-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift-kni/commatrix Red Hat Openshift Data Foundation 4 Not affected odf4/mcg-core-rhel9 Red Hat Openshift Data Foundation 4 Not affected odf4/odf-cloudnative-pg-rhel9-operator Red Hat Openshift Data Foundation 4 Not affected odf4/odf-must-gather-rhel9 Red Hat OpenShift Dev Spaces Not affected devspaces/traefik-rhel9 Red Hat OpenShift for Windows Containers Not affected openshift4-wincw/windows-machine-config-rhel9-operator Red Hat OpenShift GitOps Not affected openshift-gitops-1/argocd-rhel8 Red Hat OpenShift GitOps Not affected openshift-gitops-1/argocd-rhel9 Red Hat OpenShift GitOps Not affected openshift-gitops-1/must-gather-rhel8 Red Hat OpenShift GitOps Not affected openshift-gitops-1/must-gather-rhel9 Red Hat OpenShift Virtualization 4 Not affected container-native-virtualization/cnv-must-gather-rhel8 Red Hat OpenShift Virtualization 4 Not affected container-native-virtualization/cnv-must-gather-rhel9 Red Hat OpenShift Virtualization 4 Not affected container-native-virtualization/multus-dynamic-networks-rhel9 Red Hat OpenStack Platform 16.2 Not affected rhosp-rhel8/osp-director-operator-bundle Red Hat OpenStack Platform 17.1 Not affected rhosp-rhel9/osp-director-operator-bundle Red Hat OpenStack Platform 18.0 Not affected rhoso-operators/openstack-operator-bundle Red Hat OpenStack Platform 18.0 Not affected rhoso-operators/rabbitmq-cluster-rhel9-operator Red Hat Trusted Artifact Signer Not affected rhtas/policy-controller-rhel9-operator Red Hat Trusted Profile Analyzer Not affected rhtpa/rhtpa-rhel9-operator https://www.cve.org/CVERecord?id=CVE-2026-46680 https://nvd.nist.gov/vuln/detail/CVE-2026-46680 https://github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w