CVE-2026-50195: containerd Image Poisoning RCE Vulnerability

CVE-2026-50195 Overview

CVE-2026-50195 is an image reference validation flaw in containerd, an open-source container runtime widely deployed in Kubernetes clusters. The vulnerability resides in the Container Runtime Interface (CRI) checkpoint import process, which fails to validate image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can supply a crafted checkpoint image that forces containerd to pull an attacker-controlled image and store it under an arbitrary local tag. This poisons the node's local image cache. The issue is tracked under [CWE-345: Insufficient Verification of Data Authenticity].

Critical Impact
Subsequent pods on the same node using IfNotPresent or Never pull policies execute the attacker's malicious image under the victim pod's identity, resulting in arbitrary code execution within the compromised workload.

Affected Products

containerd versions prior to 2.3.2
containerd versions prior to 2.2.5
containerd versions prior to 2.1.9

Discovery Timeline

2026-07-01 - CVE-2026-50195 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-50195

Vulnerability Analysis

The vulnerability affects containerd's CRI checkpoint import feature, which restores container state from a checkpoint image. When containerd processes a checkpoint image, it reads image reference metadata from the checkpoint's configuration but does not verify that the reference matches trusted sources. An authorized attacker with pod-creation privileges submits a crafted checkpoint whose embedded configuration instructs containerd to pull a malicious image and register it under an arbitrary local tag, such as one impersonating a legitimate internal image. The node's image store then contains a poisoned entry indistinguishable from the legitimate tag at the local layer. Any workload that later requests the poisoned tag with a non-strict pull policy consumes the attacker-controlled image without triggering a remote pull that would otherwise reveal the discrepancy.

Root Cause

The root cause is missing validation of image reference authenticity during checkpoint import. containerd trusts the image reference field within the checkpoint configuration and does not enforce that the pulled content is bound to the intended registry, repository, or digest. This produces a trust boundary violation classified under [CWE-345].

Attack Vector

Exploitation requires low-privilege access to create pods on the target node. The attack proceeds in three stages. First, the attacker submits a checkpoint image referencing a malicious upstream image and an arbitrary local tag. Second, containerd pulls the malicious image and stores it under the attacker-chosen tag. Third, a co-located pod that references the poisoned tag with imagePullPolicy: IfNotPresent or imagePullPolicy: Never runs the malicious image. No user interaction is required from the victim workload.

Code examples are not published. See the GitHub Security Advisory for full technical details.

Detection Methods for CVE-2026-50195

Indicators of Compromise

Unexpected image pulls originating from CRI checkpoint import operations on Kubernetes nodes.
Local image cache entries whose tag references a trusted internal repository but whose digest resolves to an untrusted external registry.
Container processes running unexpected binaries or connecting to unfamiliar external endpoints under a legitimate pod identity.

Detection Strategies

Audit containerd logs for CheckpointImage and ImportImage events, correlating the source of the checkpoint with the resulting image reference stored locally.
Compare image digests present in the containerd content store against the digests of the same tags in the authoritative registry.
Alert on pod specifications that use imagePullPolicy: Never or IfNotPresent for images whose local tags were recently created via checkpoint import.

Monitoring Recommendations

Ingest containerd and Kubernetes audit logs into a centralized analytics pipeline and enrich them with registry provenance data.
Monitor RBAC changes that grant pods/create or checkpoint-related permissions to service accounts and non-administrative users.
Track outbound network connections from container runtime processes to detect pulls from unapproved registries.

How to Mitigate CVE-2026-50195

Immediate Actions Required

Upgrade containerd to version 2.3.2, 2.2.5, or 2.1.9 depending on the deployed release branch.
Restrict pod creation and checkpoint import privileges to trusted principals using Kubernetes RBAC.
Inspect nodes for suspicious local image tags introduced through checkpoint operations and purge unverified entries.

Patch Information

The containerd maintainers fixed the flaw in versions 2.3.2, 2.2.5, and 2.1.9. The patched releases enforce validation of image references contained in checkpoint configurations. Refer to the GitHub Security Advisory GHSA-cvxm-645q-p574 for release notes and commit references.

Workarounds

Disable CRI checkpoint/restore functionality on nodes that do not require it until the runtime is patched.
Enforce imagePullPolicy: Always combined with signed-image verification (for example, Sigstore cosign policies) to prevent use of poisoned local cache entries.
Apply admission controllers that reject pod specifications referencing tags not sourced from approved registries.

bash

# Verify installed containerd version and upgrade if vulnerable
containerd --version

# Example: enforce Always pull policy in a pod spec
# spec:
#   containers:
#     - name: app
#       image: registry.example.com/app:1.0
#       imagePullPolicy: Always