containerd has 17 CVEs on record between 2021 and 2026. Disclosure cadence is accelerating: 6 in the last 90 days against 2 in the 90 before. The busiest recent month was October 2026 with 4. The median CVSS is 6.2 (medium), with 1 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-400 (4). Most affected products: github.com/containerd/containerd (9), containerd (4), github.com/containerd/containerd/v2 (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.2
- Publish → KEV
- —
- Last 90 days
- 6 prev 2
Products
- github.com/containerd/containerd 9
- containerd 4
- github.com/containerd/containerd/v2 2
- overlaybd 1
- runwasi 1
Worst active — by depth score
CVE-2026-47218Critical· 9.3runwasi facilitates running Wasm and WASI workloads managed by containerd51CVE-2021-43816High· 8.0Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux44CVE-2026-95837High· 7.8containerd is an open-source container runtime43CVE-2020-15257Medium· 5.2containerd-shim API Exposed to Host Network Containers41CVE-2026-53493Medium· 6.9containerd is an open-source container runtime38
containerd vulnerabilities
CVEs affecting containerd, newest first. Open any entry for full detail, references, and exploit status.
17 CVEsRSS
CVE-2026-47218Critical· 9.3runwasi facilitates running Wasm and WASI workloads managed by containerd
runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile…
CVE-2026-95838Medium· 4.6containerd is an open-source container runtime
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger…
CVE-2026-95837High· 7.8containerd is an open-source container runtime
containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing th…
CVE-2026-107446Medium· 6.8containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for index_bytes, if an untrusted overlaybd blob from a registry is used in a scenario with multiple o…
containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for index_bytes, if an untrusted overlaybd blob from a registry is used in a scenario with multiple o…
CVE-2026-53493Medium· 6.9containerd is an open-source container runtime
containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCr…
CVE-2026-53495Medium· 6.8containerd is an open-source container runtime
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go …
CVE-2026-47262Mediumcontainerd image-triggered runtime DoS via unbounded group parsing
containerd image-triggered runtime DoS via unbounded group parsing
CVE-2026-50195Mediumcontainerd: CRI checkpoint import allows local image tag poisoning
containerd: CRI checkpoint import allows local image tag poisoning
CVE-2021-21334Medium· 6.3containerd environment variable leak
containerd environment variable leak
GHSA-7ww5-4wqc-m92cMediumcontainerd allows RAPL to be accessible to a container
containerd allows RAPL to be accessible to a container
CVE-2022-23471Medium· 5.7containerd CRI stream server vulnerable to host memory exhaustion via terminal
containerd CRI stream server vulnerable to host memory exhaustion via terminal
CVE-2022-31030Medium· 5.5containerd CRI plugin: Host memory exhaustion through ExecSync
containerd CRI plugin: Host memory exhaustion through ExecSync
CVE-2020-15157Medium· 6.1containerd v1.2.x can be coerced into leaking credentials during image pull
containerd v1.2.x can be coerced into leaking credentials during image pull
CVE-2021-43816High· 8.0Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux
Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux
GHSA-5j5w-g665-5m35Low· 3.0Ambiguous OCI manifest parsing
Ambiguous OCI manifest parsing
CVE-2021-41103Medium· 5.9Insufficiently restricted permissions on plugin directories
Insufficiently restricted permissions on plugin directories
CVE-2020-15257Medium· 5.2PoCcontainerd-shim API Exposed to Host Network Containers
containerd-shim API Exposed to Host Network Containers