containerd
containerd is the CNCF container runtime used as the default in Kubernetes and under Docker Engine. NVD tracks it as linuxfoundation:containerd. Low-level OCI runtime escapes that overwrite host binaries are attributed to runc, not this product.
Querying containerd
containerd1.5.0, 1.7.29curl "https://api.attestd.io/v1/check?product=containerd&version=1.5.0" \
-H "Authorization: Bearer $ATTESTD_KEY"containerd 1.5.0 is affected by CVE-2021-41103 (insecure permissions on container rootfs) and CVE-2022-23648 (host file exposure via crafted image config). The response shows risk_state: "high".
{
"product": "containerd",
"version": "1.5.0",
"supported": true,
"risk_state": "critical",
"risk_factors": [
"remote_code_execution",
"no_authentication_required",
"internet_exposed_service",
"patch_available"
],
"actively_exploited": false,
"remote_exploitable": true,
"authentication_required": false,
"patch_available": true,
"fixed_version": null,
"confidence": 0.5,
"cve_ids": [
"CVE-2021-32760",
"CVE-2021-41103",
"CVE-2021-43816",
"CVE-2022-23471",
"CVE-2022-23648",
"CVE-2022-31030",
"CVE-2023-25153",
"CVE-2023-25173",
"CVE-2024-25621",
"CVE-2024-40635",
"CVE-2025-64329"
],
"cves": null,
"max_epss": 0.27392,
"last_updated": "2026-07-13T05:14:04.466232Z",
"supply_chain": null,
"supply_chain_monitored": false,
"typosquat": null
}containerd 1.7.29 includes the upstream fixes for CVE-2021-43816, CVE-2022-23648, CVE-2024-40635, and CVE-2021-41103.
curl "https://api.attestd.io/v1/check?product=containerd&version=1.7.29" \
-H "Authorization: Bearer $ATTESTD_KEY"CVE history
containerd CVEs concentrate on mount labeling, image config parsing, and permission handling on the container root filesystem. Host binary overwrite escapes belong to runc (for example CVE-2024-21626), not containerd.
| CVE | Description | Affects | CVSS |
|---|---|---|---|
CVE-2021-43816 | SELinux-enabled installs can be escaped via incorrect mount labeling. | ≥1.5.1 <1.5.9 | 9.1 |
CVE-2022-23648 | Specially crafted image config exposes host files via volume mounts. | <1.4.13 / ≥1.5 <1.5.10 / ≥1.6 <1.6.1 | 7.5 |
CVE-2024-40635 | Containers with a User namespace directive can gain unexpected privileges. | <1.6.38 / ≥1.7 <1.7.27 / ≥2.0 <2.0.4 | 7.8 |
CVE-2021-41103 | Insecure / permissions on container rootfs allow local privilege escalation. | <1.4.11 / ≥1.5 <1.5.7 | 7.8 |
CVE-2023-25173 | Supplemental groups not dropped on exec, enabling privilege escalation. | 1.6.x before 1.6.18 | 7.8 |