CVE-2026-50195
Description
A flaw was found in containerd, an open-source container runtime. The CRI (Container Runtime Interface) checkpoint import process fails to validate image references within a checkpoint image's configuration. An attacker with permissions to create pods can exploit this by using a specially crafted checkpoint image to force containerd to pull a malicious image and assign it an arbitrary local tag. This action poisons the node's local image cache, leading to other pods unknowingly executing the attacker's malicious image instead of the legitimate one, which can result in arbitrary code execution under the victim pod's identity.
Statement
Red Hat products include the containerd Go module (v1.x) as a library dependency. The vulnerable CRI checkpoint import functionality was introduced in containerd v2.1.0 and is not present in the v1 module shipped in Red Hat products. Additionally, Red Hat products use CRI-O as the container runtime, not containerd, so the CRI checkpoint import code path is not exercised.
Mitigation
No mitigation is needed as the vulnerable code is not present in the containerd versions shipped in Red Hat products.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.7 | 9.9 | N/A |
| Attack Vector | Local | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | High | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Changed | N/A |
| Confidentiality | High | High | N/A |
| Integrity Impact | High | High | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
