Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-01T00:11:20 github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CWE-78

containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.

A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) plugin, which manages container operations, fails to validate labels propagated from an image configuration to a container. This oversight could enable an attacker to execute arbitrary commands on the host system through a plugin that processes these unvalidated labels. The primary impact is host-root command execution, allowing unauthorized control over the underlying system.

A flaw was found in containerd where the CRI plugin propagates labels from an image configuration (LABEL instruction in a Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host via a plugin that consumes container labels for operations, such as the restart-monitor binary:// logger. An attacker who can cause a crafted container image to be pulled and run can achieve host-level code execution. Restrict container image pulls to trusted registries using admission policies or image signature verification. Where containerd is used as the container runtime, disable or restrict the binary:// logger URI scheme in the containerd configuration to prevent the label-to-logger attack path. multicluster engine for Kubernetes 2.10 2026-07-09T00:00:00Z RHSA-2026:37252 multicluster-engine/assisted-installer-agent-rhel9:1783592566 multicluster engine for Kubernetes 2.10 2026-07-09T00:00:00Z RHSA-2026:37252 multicluster-engine/assisted-service-9-rhel9:1783350355 multicluster engine for Kubernetes 2.6 2026-07-07T00:00:00Z RHSA-2026:36105 multicluster-engine/assisted-installer-controller-rhel8:1783407939 multicluster engine for Kubernetes 2.6 2026-07-07T00:00:00Z RHSA-2026:36105 multicluster-engine/assisted-installer-rhel8:1783407900 multicluster engine for Kubernetes 2.6 2026-07-07T00:00:00Z RHSA-2026:36105 multicluster-engine/assisted-service-8-rhel8:1783332008 multicluster engine for Kubernetes 2.6 2026-07-07T00:00:00Z RHSA-2026:36167 multicluster-engine/assisted-service-9-rhel9:1783333268 Red Hat Advanced Cluster Management for Kubernetes 2.13 2026-07-08T00:00:00Z RHSA-2026:36873 rhacm2/submariner-rhel9-operator:1782933193 Red Hat Advanced Cluster Security 4.9 2026-07-07T00:00:00Z RHSA-2026:36319 advanced-cluster-security/rhacs-main-rhel8:1783357116 Red Hat Advanced Cluster Security for Kubernetes 4.10 2026-07-08T00:00:00Z RHSA-2026:36625 advanced-cluster-security/rhacs-main-rhel8:1783357140 Red Hat Advanced Cluster Security for Kubernetes 4.11 2026-07-07T00:00:00Z RHSA-2026:36207 advanced-cluster-security/rhacs-main-rhel9:1783352589 Red Hat Advanced Cluster Security for Kubernetes 4.11 2026-07-07T00:00:00Z RHSA-2026:36207 advanced-cluster-security/rhacs-operator-bundle:1783352589 Red Hat Advanced Cluster Security for Kubernetes 4.11 2026-07-07T00:00:00Z RHSA-2026:36207 advanced-cluster-security/rhacs-rhel9-operator:1783352589 Red Hat Advanced Cluster Security for Kubernetes 4.11 2026-07-07T00:00:00Z RHSA-2026:36207 advanced-cluster-security/rhacs-roxctl-rhel9:1783352589 Red Hat Advanced Cluster Security for Kubernetes 4.11 2026-07-07T00:00:00Z RHSA-2026:36207 advanced-cluster-security/rhacs-scanner-v4-rhel9:1783352589 Red Hat Hardened Images 2026-07-02T00:00:00Z RHSA-2026:35111 trivy-main-0.72.0-0.1.hum1 Red Hat multicluster global hub 1.4.3 2026-07-16T00:00:00Z RHSA-2026:41030 multicluster-globalhub/multicluster-globalhub-agent-rhel9:1784061472 Red Hat multicluster global hub 1.4.3 2026-07-16T00:00:00Z RHSA-2026:41030 multicluster-globalhub/multicluster-globalhub-grafana-rhel9:1784060681 Red Hat multicluster global hub 1.4.3 2026-07-16T00:00:00Z RHSA-2026:41030 multicluster-globalhub/multicluster-globalhub-manager-rhel9:1784061010 Red Hat multicluster global hub 1.4.3 2026-07-16T00:00:00Z RHSA-2026:41030 multicluster-globalhub/multicluster-globalhub-rhel9-operator:1784060515 Assisted Installer for Red Hat OpenShift Container Platform 2 Affected assisted/agent-preinstall-image-builder-rhel9 Assisted Installer for Red Hat OpenShift Container Platform 2 Affected rhai/assisted-installer-agent-rhel9 Confidential Compute Attestation Affected openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9 Confidential Compute Attestation Affected openshift-sandboxed-containers/osc-monitor-rhel9 Confidential Compute Attestation Affected openshift-sandboxed-containers/osc-must-gather-rhel9 Confidential Compute Attestation Affected openshift-sandboxed-containers/osc-podvm-payload-rhel9 Deployment Validation Operator Affected dvo/deployment-validation-rhel8-operator Gatekeeper 3 Affected gatekeeper/gatekeeper-rhel9 Kernel Module Management Operator for Red Hat Openshift Affected kmm/kernel-module-management-must-gather-rhel9 Logging Subsystem for Red Hat OpenShift Not affected openshift-logging/cluster-logging-rhel9-operator Logical Volume Manager Storage Affected lvms4/lvms-must-gather-rhel9 Machine Deletion Remediation Operator Affected workload-availability/machine-deletion-remediation-operator-bundle Machine Deletion Remediation Operator Affected workload-availability/machine-deletion-remediation-rhel9-operator MCP Server for Red Hat OpenShift Affected openshift-mcp-beta/openshift-mcp-server-rhel9 Migration Toolkit for Containers Affected rhmtc/openshift-migration-log-reader-rhel8 Migration Toolkit for Containers Affected rhmtc/openshift-migration-must-gather-rhel8 Migration Toolkit for Virtualization Affected migration-toolkit-virtualization/mtv-must-gather-rhel8 Migration Toolkit for Virtualization Affected migration-toolkit-virtualization/mtv-must-gather-rhel9 Migration Toolkit for Virtualization Will not fix mtv-candidate/mtv-must-gather-rhel8 Multicluster Engine for Kubernetes Affected multicluster-engine/assisted-installer-agent-rhel8 Multicluster Engine for Kubernetes Affected multicluster-engine/must-gather-rhel9 Node HealthCheck Operator Affected workload-availability/node-healthcheck-must-gather-rhel9 OpenShift API for Data Protection Affected oadp/oadp-mustgather-rhel9 OpenShift Developer Tools and Services Out of support scope ocp-tools-4/jenkins-agent-base-rhel8 OpenShift Developer Tools and Services Affected ocp-tools-4/jenkins-agent-base-rhel9 OpenShift Developer Tools and Services Affected ocp-tools-4/jenkins-rhel8 OpenShift Developer Tools and Services Affected ocp-tools-4/jenkins-rhel9 OpenShift Lightspeed Affected openshift-lightspeed/lightspeed-agentic-sandbox-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed/openshift-mcp-server-rhel9 OpenShift Pipelines Affected openshift-pipelines/pipelines-controller-rhel8 OpenShift Pipelines Affected openshift-pipelines/pipelines-entrypoint-rhel8 OpenShift Pipelines Affected openshift-pipelines/pipelines-results-watcher-rhel8 OpenShift Pipelines Affected openshift-pipelines/pipelines-sidecarlogresults-rhel8 OpenShift Serverless Affected openshift-serverless-1/serverless-must-gather-rhel9 OpenShift Service Mesh 2 Not affected openshift-service-mesh/istio-must-gather-rhel9 OpenShift Service Mesh 2 Not affected openshift-service-mesh/istio-rhel8-operator OpenShift Service Mesh 3 Not affected openshift-service-mesh/istio-must-gather-rhel9 OpenShift Service Mesh 3 Not affected openshift-service-mesh/istio-rhel9-operator Pen Drive Powered by Red Hat Lightspeed Not affected pen-drive/pen-drive-scanner-rhel9 Power monitoring for Red Hat OpenShift Affected openshift-power-monitoring/power-monitoring-rhel9-operator Red Hat Advanced Cluster Management for Kubernetes 2 Affected rhacm2/acm-grafana-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Affected rhacm2/acm-must-gather-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Affected rhacm2/multicloud-integrations-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Affected rhacm2/multiclusterhub-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Affected rhacm2/multicluster-operators-channel-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Affected rhacm2/multicluster-operators-subscription-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/submariner-operator-bundle Red Hat Advanced Cluster Security 4 Affected advanced-cluster-security/rhacs-rhel8-operator Red Hat Advanced Cluster Security 4 Affected advanced-cluster-security/rhacs-roxctl-rhel8 Red Hat Advanced Cluster Security 4 Affected advanced-cluster-security/rhacs-scanner-v4-rhel8 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-24/aap-must-gather-rhel8 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-25/aap-must-gather-rhel8 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/aap-must-gather-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-27/aap-must-gather-rhel9 Red Hat Build of Kueue Not affected kueue/kueue-must-gather-rhel9 Red Hat Ceph Storage 6 Fix deferred rhceph/rhceph-promtail-rhel9 Red Hat Ceph Storage 9 Fix deferred rhceph/alloy-rhel10 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-must-gather-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-spark-operator-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/rhai-cli-rhel9 Red Hat OpenShift Container Platform 4 Not affected kata-containers Red Hat OpenShift Container Platform 4 Affected openshift4/cnf-tests-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/cnf-tests-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/container-networking-plugins-microshift-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4-dev-preview-beta/openperouter-edge-rhel10-operator Red Hat OpenShift Container Platform 4 Affected openshift4-dev-preview-beta/openperouter-operator-bundle Red Hat OpenShift Container Platform 4 Affected openshift4-dev-preview-beta/openperouter-rhel9-operator Red Hat OpenShift Container Platform 4 Not affected openshift4/kube-compare-artifacts-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/lifecycle-agent-rhel9-operator Red Hat OpenShift Container Platform 4 Affected openshift4/metallb-rhel8-operator Red Hat OpenShift Container Platform 4 Affected openshift4/metallb-rhel9-operator Red Hat OpenShift Container Platform 4 Affected openshift4/network-tools-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/network-tools-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/numaresources-must-gather-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/numaresources-operator-bundle Red Hat OpenShift Container Platform 4 Affected openshift4/numaresources-rhel9-operator Red Hat OpenShift Container Platform 4 Affected openshift4/oc-mirror-plugin-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/oc-mirror-plugin-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-agent-installer-api-server-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-agent-installer-api-server-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-agent-installer-csr-approver-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-agent-installer-csr-approver-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-agent-installer-node-agent-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-agent-installer-orchestrator-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-agent-installer-orchestrator-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-ansible-operator Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-azure-cluster-api-controllers-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-baremetal-installer-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-cli Red Hat OpenShift Container Platform 4 Affected openshift4/ose-cli-artifacts Red Hat OpenShift Container Platform 4 Affected openshift4/ose-cli-artifacts-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-cli-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-cluster-ingress-rhel9-operator Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-cluster-kube-cluster-api-rhel8-operator Red Hat OpenShift Container Platform 4 Affected openshift4/ose-cluster-olm-rhel9-operator Red Hat OpenShift Container Platform 4 Affected openshift4/ose-console Red Hat OpenShift Container Platform 4 Affected openshift4/ose-console-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-container-networking-plugins-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-container-networking-plugins-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-csi-driver-shared-resource-mustgather-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-csi-driver-shared-resource-mustgather-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-deployer Red Hat OpenShift Container Platform 4 Affected openshift4/ose-deployer-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-docker-builder Red Hat OpenShift Container Platform 4 Affected openshift4/ose-docker-builder-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-docker-registry Red Hat OpenShift Container Platform 4 Affected openshift4/ose-helm-operator Red Hat OpenShift Container Platform 4 Affected openshift4/ose-helm-rhel9-operator Red Hat OpenShift Container Platform 4 Affected openshift4/ose-installer-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-local-storage-mustgather-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-local-storage-mustgather-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-machine-os-images-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-must-gather Red Hat OpenShift Container Platform 4 Affected openshift4/ose-must-gather-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-node-feature-discovery Red Hat OpenShift Container Platform 4 Affected openshift4/ose-olm-catalogd-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-olm-catalogd-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-olm-operator-controller-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-olm-operator-controller-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-olm-rukpak-rhel8 Red Hat OpenShift Container Platform 4 Will not fix openshift4/ose-olm-rukpak-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-operator-framework-tools-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-operator-lifecycle-manager Red Hat OpenShift Container Platform 4 Affected openshift4/ose-operator-lifecycle-manager-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-operator-registry Red Hat OpenShift Container Platform 4 Affected openshift4/ose-operator-registry-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-operator-sdk-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-operator-sdk-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-ovn-kubernetes Red Hat OpenShift Container Platform 4 Affected openshift4/ose-sdn-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-secrets-store-csi-mustgather-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-secrets-store-csi-mustgather-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-tests Red Hat OpenShift Container Platform 4 Affected openshift4/ose-tests-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-tools-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-tools-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ptp-must-gather-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ptp-must-gather-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ztp-site-generate-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift-kni/commatrix Red Hat Openshift Data Foundation 4 Not affected odf4/mcg-core-rhel9 Red Hat Openshift Data Foundation 4 Affected odf4/odf-cloudnative-pg-rhel9-operator Red Hat Openshift Data Foundation 4 Not affected odf4/odf-must-gather-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/traefik-rhel9 Red Hat OpenShift for Windows Containers Affected openshift4-wincw/windows-machine-config-rhel9-operator Red Hat OpenShift GitOps Affected openshift-gitops-1/argocd-rhel8 Red Hat OpenShift GitOps Affected openshift-gitops-1/argocd-rhel9 Red Hat OpenShift GitOps Affected openshift-gitops-1/must-gather-rhel8 Red Hat OpenShift GitOps Affected openshift-gitops-1/must-gather-rhel9 Red Hat OpenShift Virtualization 4 Not affected container-native-virtualization/cnv-must-gather-rhel8 Red Hat OpenShift Virtualization 4 Not affected container-native-virtualization/cnv-must-gather-rhel9 Red Hat OpenShift Virtualization 4 Affected container-native-virtualization/multus-dynamic-networks-rhel9 Red Hat OpenStack Platform 16.2 Not affected rhosp-rhel8/osp-director-operator-bundle Red Hat OpenStack Platform 17.1 Not affected rhosp-rhel9/osp-director-operator-bundle Red Hat OpenStack Platform 18.0 Not affected rhoso-operators/openstack-operator-bundle Red Hat OpenStack Platform 18.0 Affected rhoso-operators/rabbitmq-cluster-rhel9-operator Red Hat Trusted Artifact Signer Affected rhtas/policy-controller-rhel9-operator Red Hat Trusted Profile Analyzer Affected rhtpa/rhtpa-rhel9-operator https://www.cve.org/CVERecord?id=CVE-2026-53488 https://nvd.nist.gov/vuln/detail/CVE-2026-53488 https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp