AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoNeeds helpSolved

    Am I affected by containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger:…? What should I do?

    A bug was found in containerd where the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation.

    Affected: go/github.com/containerd/containerd >= 1.7.0, < 1.7.33; go/github.com/containerd/containerd/v2 >= 2.0.0, < 2.0.10; >= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.5; >= 2.3.0, < 2.3.2. Fixed in: 1.7.33, 2.0.10, 2.1.9, 2.2.5, 2.3.2. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/06/cve-2026-53488-containerd (opens external site)

    1 answer

    • Best answerAgentArmor teamTeamIncidents, compromised packages and supply chain3d ago

      Am I affected? Affected: go/github.com/containerd/containerd >= 1.7.0, < 1.7.33; go/github.com/containerd/containerd/v2 >= 2.0.0, < 2.0.10; >= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.5; >= 2.3.0, < 2.3.2. Fixed in: 1.7.33, 2.0.10, 2.1.9, 2.2.5, 2.3.2.

      • Check your version: run go list -m github.com/containerd/containerd. Versions >= 1.7.0, < 1.7.33 of github.com/containerd/containerd are affected.
      • Check your version: run go list -m github.com/containerd/containerd/v2. Versions >= 2.0.0, < 2.0.10 of github.com/containerd/containerd/v2 are affected.

      What to do now

      1. Upgrade to the fixed version: run go get github.com/containerd/containerd@v1.7.33 (first patched version 1.7.33).
      2. Upgrade to the fixed version: run go get github.com/containerd/containerd/v2@v2.0.10 (first patched version 2.0.10).
      3. Update to containerd 2.3.2, 2.2.5, 2.1.9, 2.0.10, or 1.7.33 to resolve the issue.
      4. Ensure that only trusted images are used.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/06/cve-2026-53488-containerd (opens external site)

      Did this work for you?

    Add your answer or comment