Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-01T17:59:12 github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration. 8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N CWE-807

containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations from the checkpoint archive rather than relying solely on the pod's create-time specification. This allows a user with pod creation permissions to bypass standard Kubernetes resource allocation and device plugin enforcement, injecting arbitrary CDI edits (such as device nodes and host mounts) into the restored container. Successful exploitation requires that the node has CDI enabled and contains a matching host CDI specification for the requested device; environments where CDI is disabled or lacking sensitive device specifications are not affected. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.

A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) implementation, which allows Kubernetes to interact with container runtimes, improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. This vulnerability enables a user with permissions to create pods to bypass standard Kubernetes resource allocation and device plugin enforcement. Consequently, an attacker can inject arbitrary CDI edits, such as device nodes and host mounts, into the restored container, potentially leading to unauthorized resource access or privilege escalation.

This flaw is rated as Important. In Red Hat OpenShift Container Platform, a user with pod creation permissions could bypass standard Kubernetes resource allocation and device plugin enforcement. This is due to containerd's Container Runtime Interface (CRI) improperly trusting Container Device Interface (CDI) annotations during container restoration. Exploitation requires CDI to be enabled on the node and a matching host CDI specification for the requested device. Multicluster Global Hub 1.4.5 2026-07-16T00:00:00Z RHSA-2026:41030 multicluster-globalhub/multicluster-globalhub-agent-rhel9:1784061472 Multicluster Global Hub 1.4.5 2026-07-16T00:00:00Z RHSA-2026:41030 multicluster-globalhub/multicluster-globalhub-grafana-rhel9:1784060681 Multicluster Global Hub 1.4.5 2026-07-16T00:00:00Z RHSA-2026:41030 multicluster-globalhub/multicluster-globalhub-manager-rhel9:1784061010 Multicluster Global Hub 1.4.5 2026-07-16T00:00:00Z RHSA-2026:41030 multicluster-globalhub/multicluster-globalhub-rhel9-operator:1784060515 Red Hat Advanced Cluster Management for Kubernetes 2.13 2026-07-08T00:00:00Z RHSA-2026:36873 rhacm2/submariner-rhel9-operator:1782933193 Red Hat Hardened Images 2026-05-09T00:00:00Z RHSA-2026:15862 trivy-main-0.69.3-1.2.hum1 Red Hat Hardened Images 2026-06-29T00:00:00Z RHSA-2026:32963 grype-main-0.115.0-0.1.hum1 Red Hat Hardened Images 2026-06-29T00:00:00Z RHSA-2026:32974 syft-main-1.46.0-0.1.hum1 Assisted Installer for Red Hat OpenShift Container Platform 2 Affected assisted/agent-preinstall-image-builder-rhel9 Assisted Installer for Red Hat OpenShift Container Platform 2 Affected rhai/assisted-installer-agent-rhel9 Confidential Compute Attestation Affected openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9 Confidential Compute Attestation Affected openshift-sandboxed-containers/osc-monitor-rhel9 Confidential Compute Attestation Affected openshift-sandboxed-containers/osc-must-gather-rhel9 Confidential Compute Attestation Affected openshift-sandboxed-containers/osc-podvm-payload-rhel9 Deployment Validation Operator Affected dvo/deployment-validation-rhel8-operator Exploit Intelligence Affected exploit-intelligence-tech-preview/agent-client-rhel9 Gatekeeper 3 Affected gatekeeper/gatekeeper-rhel9 Kernel Module Management Operator for Red Hat Openshift Affected kmm/kernel-module-management-must-gather-rhel9 Logging Subsystem for Red Hat OpenShift Not affected openshift-logging/cluster-logging-rhel9-operator Logging Subsystem for Red Hat OpenShift Not affected openshift-logging/logging-loki-rhel9 Logical Volume Manager Storage Affected lvms4/lvms-must-gather-rhel9 Machine Deletion Remediation Operator Affected workload-availability/machine-deletion-remediation-operator-bundle Machine Deletion Remediation Operator Affected workload-availability/machine-deletion-remediation-rhel9-operator MCP Server for Red Hat OpenShift Affected openshift-mcp-beta/openshift-mcp-server-rhel9 Migration Toolkit for Containers Affected rhmtc/openshift-migration-log-reader-rhel8 Migration Toolkit for Containers Affected rhmtc/openshift-migration-must-gather-rhel8 Migration Toolkit for Virtualization Affected migration-toolkit-virtualization/mtv-must-gather-rhel8 Migration Toolkit for Virtualization Affected migration-toolkit-virtualization/mtv-must-gather-rhel9 Migration Toolkit for Virtualization Affected migration-toolkit-virtualization/mtv-validation-rhel9 Migration Toolkit for Virtualization Will not fix mtv-candidate/mtv-api-rhel9 Migration Toolkit for Virtualization Will not fix mtv-candidate/mtv-cli-download-rhel9 Migration Toolkit for Virtualization Will not fix mtv-candidate/mtv-controller-rhel9 Migration Toolkit for Virtualization Will not fix mtv-candidate/mtv-must-gather-rhel8 Migration Toolkit for Virtualization Will not fix mtv-candidate/mtv-openstack-populator-rhel9 Migration Toolkit for Virtualization Will not fix mtv-candidate/mtv-operator-bundle Migration Toolkit for Virtualization Will not fix mtv-candidate/mtv-ova-provider-server-rhel9 Migration Toolkit for Virtualization Will not fix mtv-candidate/mtv-populator-controller-rhel9 Migration Toolkit for Virtualization Will not fix mtv-candidate/mtv-rhel9-operator Migration Toolkit for Virtualization Will not fix mtv-candidate/mtv-rhv-populator-rhel8 Migration Toolkit for Virtualization Will not fix mtv-candidate/mtv-validation-rhel9 Migration Toolkit for Virtualization Will not fix mtv-candidate/mtv-virt-v2v-rhel9 Migration Toolkit for Virtualization Will not fix mtv-candidate/mtv-vsphere-xcopy-volume-populator-rhel9 Multicluster Engine for Kubernetes Affected multicluster-engine/assisted-installer-agent-rhel8 Multicluster Engine for Kubernetes Affected multicluster-engine/assisted-installer-agent-rhel9 Multicluster Engine for Kubernetes Affected multicluster-engine/assisted-installer-controller-rhel8 Multicluster Engine for Kubernetes Affected multicluster-engine/assisted-installer-controller-rhel9 Multicluster Engine for Kubernetes Affected multicluster-engine/assisted-installer-rhel8 Multicluster Engine for Kubernetes Affected multicluster-engine/assisted-service-8-rhel8 Multicluster Engine for Kubernetes Affected multicluster-engine/assisted-service-9-rhel9 Multicluster Engine for Kubernetes Affected multicluster-engine/must-gather-rhel9 Node HealthCheck Operator Affected workload-availability/node-healthcheck-must-gather-rhel9 OpenShift API for Data Protection Affected oadp/oadp-mustgather-rhel9 OpenShift Developer Tools and Services Fix deferred ocp-tools-4/jenkins-agent-base-rhel8 OpenShift Developer Tools and Services Affected ocp-tools-4/jenkins-agent-base-rhel9 OpenShift Developer Tools and Services Affected ocp-tools-4/jenkins-rhel8 OpenShift Developer Tools and Services Affected ocp-tools-4/jenkins-rhel9 OpenShift Lightspeed Affected openshift-lightspeed/lightspeed-agentic-sandbox-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed/openshift-mcp-server-rhel9 OpenShift Pipelines Affected openshift-pipelines/pipelines-controller-rhel8 OpenShift Pipelines Affected openshift-pipelines/pipelines-entrypoint-rhel8 OpenShift Pipelines Affected openshift-pipelines/pipelines-results-watcher-rhel8 OpenShift Pipelines Affected openshift-pipelines/pipelines-sidecarlogresults-rhel8 OpenShift Serverless Affected openshift-serverless-1/serverless-must-gather-rhel9 OpenShift Service Mesh 2 Will not fix openshift-service-mesh/istio-must-gather-rhel9 OpenShift Service Mesh 2 Will not fix openshift-service-mesh/istio-rhel8-operator OpenShift Service Mesh 3 Not affected openshift-service-mesh/istio-must-gather-rhel9 OpenShift Service Mesh 3 Not affected openshift-service-mesh/istio-rhel9-operator Pen Drive Powered by Red Hat Lightspeed Fix deferred pen-drive/pen-drive-scanner-rhel9 Pen Drive Powered by Red Hat Lightspeed Fix deferred pen-drive/pen-drive-scanner-rhel9 Power monitoring for Red Hat OpenShift Affected openshift-power-monitoring/power-monitoring-rhel9-operator Red Hat Advanced Cluster Management for Kubernetes 2 Affected rhacm2/acm-grafana-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Affected rhacm2/acm-must-gather-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Will not fix rhacm2/multicloud-integrations-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Affected rhacm2/multiclusterhub-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Will not fix rhacm2/multicluster-operators-channel-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Will not fix rhacm2/multicluster-operators-subscription-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/submariner-operator-bundle Red Hat Advanced Cluster Security 4 Affected advanced-cluster-security/rhacs-main-rhel8 Red Hat Advanced Cluster Security 4 Affected advanced-cluster-security/rhacs-main-rhel9 Red Hat Advanced Cluster Security 4 Affected advanced-cluster-security/rhacs-operator-bundle Red Hat Advanced Cluster Security 4 Affected advanced-cluster-security/rhacs-rhel8-operator Red Hat Advanced Cluster Security 4 Affected advanced-cluster-security/rhacs-rhel9-operator Red Hat Advanced Cluster Security 4 Affected advanced-cluster-security/rhacs-roxctl-rhel8 Red Hat Advanced Cluster Security 4 Affected advanced-cluster-security/rhacs-roxctl-rhel9 Red Hat Advanced Cluster Security 4 Affected advanced-cluster-security/rhacs-scanner-v4-rhel8 Red Hat Advanced Cluster Security 4 Affected advanced-cluster-security/rhacs-scanner-v4-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-24/aap-must-gather-rhel8 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-25/aap-must-gather-rhel8 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/aap-must-gather-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-27/aap-must-gather-rhel9 Red Hat Build of Kueue Not affected kueue/kueue-must-gather-rhel9 Red Hat Ceph Storage 6 Fix deferred rhceph/rhceph-promtail-rhel9 Red Hat Ceph Storage 9 Fix deferred rhceph/alloy-rhel10 Red Hat Enterprise Linux 8 Affected buildah Red Hat Enterprise Linux 8 Affected conmon Red Hat Enterprise Linux 8 Not affected containernetworking-plugins Red Hat Enterprise Linux 8 Not affected grafana Red Hat Enterprise Linux 8 Affected podman Red Hat Enterprise Linux 8 Not affected skopeo Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-data-science-pipelines-operator-controller-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-kserve-agent-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-kserve-controller-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-kserve-llmisvc-controller-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-kserve-router-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-model-registry-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-must-gather-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-spark-operator-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/rhai-cli-rhel9 Red Hat OpenShift Container Platform 4 Affected kata-containers Red Hat OpenShift Container Platform 4 Affected openshift4/cnf-tests-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/cnf-tests-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/container-networking-plugins-microshift-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4-dev-preview-beta/openperouter-edge-rhel10-operator Red Hat OpenShift Container Platform 4 Affected openshift4-dev-preview-beta/openperouter-operator-bundle Red Hat OpenShift Container Platform 4 Affected openshift4-dev-preview-beta/openperouter-rhel9-operator Red Hat OpenShift Container Platform 4 Not affected openshift4/kube-compare-artifacts-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/lifecycle-agent-rhel9-operator Red Hat OpenShift Container Platform 4 Affected openshift4/metallb-rhel8-operator Red Hat OpenShift Container Platform 4 Affected openshift4/metallb-rhel9-operator Red Hat OpenShift Container Platform 4 Affected openshift4/network-tools-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/network-tools-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/numaresources-must-gather-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/numaresources-operator-bundle Red Hat OpenShift Container Platform 4 Affected openshift4/numaresources-rhel9-operator Red Hat OpenShift Container Platform 4 Affected openshift4/oc-mirror-plugin-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/oc-mirror-plugin-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-agent-installer-api-server-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-agent-installer-api-server-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-agent-installer-csr-approver-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-agent-installer-csr-approver-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-agent-installer-node-agent-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-agent-installer-orchestrator-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-agent-installer-orchestrator-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-ansible-operator Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-azure-cluster-api-controllers-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-cli Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-cli-artifacts Red Hat OpenShift Container Platform 4 Affected openshift4/ose-cli-artifacts-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-cli-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-cluster-ingress-rhel9-operator Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-cluster-kube-cluster-api-rhel8-operator Red Hat OpenShift Container Platform 4 Affected openshift4/ose-cluster-olm-rhel9-operator Red Hat OpenShift Container Platform 4 Affected openshift4/ose-console Red Hat OpenShift Container Platform 4 Affected openshift4/ose-console-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-container-networking-plugins-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-container-networking-plugins-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-csi-driver-shared-resource-mustgather-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-csi-driver-shared-resource-mustgather-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-deployer Red Hat OpenShift Container Platform 4 Affected openshift4/ose-deployer-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-docker-builder Red Hat OpenShift Container Platform 4 Affected openshift4/ose-docker-builder-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-docker-registry Red Hat OpenShift Container Platform 4 Affected openshift4/ose-helm-operator Red Hat OpenShift Container Platform 4 Affected openshift4/ose-helm-rhel9-operator Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-local-storage-mustgather-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-local-storage-mustgather-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-machine-os-images-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-must-gather Red Hat OpenShift Container Platform 4 Affected openshift4/ose-must-gather-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-node-feature-discovery Red Hat OpenShift Container Platform 4 Affected openshift4/ose-olm-catalogd-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-olm-catalogd-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-olm-operator-controller-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-olm-operator-controller-rhel9 Red Hat OpenShift Container Platform 4 Will not fix openshift4/ose-olm-rukpak-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-olm-rukpak-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-operator-framework-tools-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-operator-lifecycle-manager Red Hat OpenShift Container Platform 4 Affected openshift4/ose-operator-lifecycle-manager-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-operator-registry Red Hat OpenShift Container Platform 4 Affected openshift4/ose-operator-registry-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-operator-sdk-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-operator-sdk-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-ovn-kubernetes Red Hat OpenShift Container Platform 4 Affected openshift4/ose-sdn-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-secrets-store-csi-mustgather-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-secrets-store-csi-mustgather-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-tests Red Hat OpenShift Container Platform 4 Affected openshift4/ose-tests-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-tools-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-tools-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ptp-must-gather-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/ptp-must-gather-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ztp-site-generate-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift-kni/commatrix Red Hat Openshift Data Foundation 4 Not affected odf4/mcg-core-rhel9 Red Hat Openshift Data Foundation 4 Affected odf4/odf-cloudnative-pg-rhel9-operator Red Hat Openshift Data Foundation 4 Not affected odf4/odf-must-gather-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/traefik-rhel9 Red Hat OpenShift for Windows Containers Affected openshift4-wincw/windows-machine-config-rhel9-operator Red Hat OpenShift GitOps Affected openshift-gitops-1/argocd-rhel8 Red Hat OpenShift GitOps Affected openshift-gitops-1/argocd-rhel9 Red Hat OpenShift GitOps Affected openshift-gitops-1/must-gather-rhel8 Red Hat OpenShift GitOps Affected openshift-gitops-1/must-gather-rhel9 Red Hat OpenShift Virtualization 4 Affected container-native-virtualization/cnv-must-gather-rhel8 Red Hat OpenShift Virtualization 4 Affected container-native-virtualization/cnv-must-gather-rhel9 Red Hat OpenShift Virtualization 4 Affected container-native-virtualization/multus-dynamic-networks-rhel9 Red Hat OpenStack Platform 16.2 Not affected rhosp-rhel8/osp-director-operator-bundle Red Hat OpenStack Platform 17.1 Not affected rhosp-rhel9/osp-director-operator-bundle Red Hat OpenStack Platform 18.0 Not affected rhoso-operators/openstack-operator-bundle Red Hat OpenStack Platform 18.0 Affected rhoso-operators/rabbitmq-cluster-rhel9-operator Red Hat Trusted Artifact Signer Affected rhtas/ec-rhel9 Red Hat Trusted Artifact Signer Affected rhtas/policy-controller-rhel9-operator Red Hat Trusted Profile Analyzer Affected rhtpa/rhtpa-rhel9-operator https://www.cve.org/CVERecord?id=CVE-2026-53492 https://nvd.nist.gov/vuln/detail/CVE-2026-53492 https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc