CVE-2026-53488: containerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull

Synopsis

This is an arbitrary command execution vulnerability in containerd's CRI plugin affecting versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5, and 2.3.2. The CRI plugin copies LABEL directives from an image's config into container metadata without validation; a downstream plugin (such as a restart-monitor using a binary:// logger) then consumes those labels and executes the embedded value as a host command. Exploitation requires no network access, no authentication, and no user interaction - an attacker who can influence the image being pulled gains arbitrary command execution on the container host. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment upstream fix versions are formally published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attack vector is local (AV:L); the attacker needs an existing shell or process on the host, not remote network access.

• AuthenticationNot required

  No privileges are required (PR:N); the attacker only needs to influence which image is pulled, without holding any account credentials on the target system.

• Victim interactionNot required

  No user interaction is required (UI:N); the malicious label is processed automatically when the image is pulled and a container is created from it.

• Attack complexityDetail

  Attack complexity is low (AC:L); the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites beyond pulling a crafted image.

Blast Radius

• A successful attacker executes arbitrary commands on the container host as the process running the affected containerd plugin, bypassing container isolation entirely.
• Host filesystem reads allow the attacker to access sensitive files including credentials, keys, and runtime secrets stored on the node.
• Host filesystem writes allow the attacker to modify or implant files, including runtime binaries, configuration files, and persistent workload data.
• Disruption of the containerd daemon or co-located workloads is possible, crashing running containers or preventing new containers from starting on the affected node.