CVE-2026-53492 Overview
CVE-2026-53492 affects containerd, an open-source container runtime widely used in Kubernetes environments. The vulnerability resides in the Container Runtime Interface (CRI) implementation, which improperly trusts Container Device Interface (CDI) annotations embedded in untrusted checkpoint image metadata during container restoration. A user with pod creation permissions can inject arbitrary CDI edits, including device nodes and host mounts, into a restored container. This bypasses standard Kubernetes resource allocation and device plugin enforcement. The flaw is tracked as an improper input validation issue [CWE-20] and impacts containerd versions prior to 2.3.2, 2.2.5, and 2.1.9.
Critical Impact
Attackers with pod creation rights can bypass device plugin controls and mount sensitive host devices into restored containers, enabling container escape on nodes with CDI enabled.
Affected Products
- containerd versions prior to 2.3.2
- containerd versions prior to 2.2.5
- containerd versions prior to 2.1.9
Discovery Timeline
- 2026-07-01 - CVE-2026-53492 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-53492
Vulnerability Analysis
The vulnerability stems from how containerd handles checkpoint restoration in the CRI implementation. Checkpoint/restore functionality allows saving a running container's state to an image and restoring it later. When restoring, containerd preserves CDI-related annotations sourced from the checkpoint archive rather than relying solely on the pod's create-time specification.
CDI is the standard Kubernetes mechanism for exposing devices such as GPUs, FPGAs, and specialized hardware to containers. Under normal operation, device plugins enforce which devices a pod may access based on the pod's requested resources. By trusting checkpoint-supplied annotations, containerd allows the checkpoint image itself to declare device access outside the pod specification.
An attacker with permission to create pods and supply a crafted checkpoint image can inject arbitrary CDI edits during restoration. These edits can include host device nodes and bind mounts, effectively granting the container privileged access to node resources without cluster-authorized allocation.
Root Cause
The root cause is improper input validation [CWE-20] of CDI annotations during checkpoint restoration. containerd treats attacker-controlled checkpoint metadata as trusted configuration rather than validating it against the authoritative pod specification.
Attack Vector
Exploitation requires the target node to have CDI enabled and to contain a matching host CDI specification for the requested device. An authenticated user with pod creation permissions supplies a malicious checkpoint image whose metadata contains CDI annotations referencing sensitive host devices. When containerd restores the container, it applies those annotations, mounting the referenced devices into the container. Environments where CDI is disabled or lacking sensitive device specifications are not affected.
No verified public exploit code is available at this time. See the containerd GitHub Security Advisory for authoritative technical details.
Detection Methods for CVE-2026-53492
Indicators of Compromise
- Container restoration events referencing checkpoint images from untrusted registries or sources.
- Restored containers with CDI annotations that do not match the originating pod specification.
- Unexpected host device nodes or bind mounts present in running containers that were not requested through the Kubernetes device plugin framework.
Detection Strategies
- Audit Kubernetes API server logs for CheckpointContainer requests and correlate with pod creation events by non-administrative users.
- Inspect containerd logs for CDI annotation processing during restore operations, focusing on annotations prefixed with cdi.k8s.io/.
- Compare the effective device set inside restored containers against the pod spec resources.limits to identify unauthorized device access.
Monitoring Recommendations
- Monitor for containerd versions running below 2.3.2, 2.2.5, or 2.1.9 across all Kubernetes nodes.
- Track privileged operations inside restored containers, including access to /dev/ device nodes not declared in the pod spec.
- Alert on any process within a container accessing host paths mounted via CDI edits that were not part of the original workload definition.
How to Mitigate CVE-2026-53492
Immediate Actions Required
- Upgrade containerd to version 2.3.2, 2.2.5, or 2.1.9 or later on all Kubernetes nodes.
- Restrict pod creation permissions using Kubernetes RBAC to minimize the set of users who can supply checkpoint images.
- Disable the checkpoint/restore feature gate on clusters that do not require it until nodes are patched.
Patch Information
The containerd maintainers fixed this issue in versions 2.3.2, 2.2.5, and 2.1.9. The patch ensures CDI annotations from checkpoint metadata are not trusted during restoration, and the restored container's CDI configuration is derived from the pod specification. Refer to the containerd GitHub Security Advisory GHSA-33vj-92qq-66hc for full remediation guidance.
Workarounds
- Disable CDI support on nodes where it is not required, which eliminates the exploitation prerequisite.
- Remove sensitive host CDI specifications from nodes that do not need to expose specialized devices to workloads.
- Enforce admission control policies that reject pods referencing checkpoint images from untrusted sources.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
