products / containerd

containerd

containerd is the CNCF container runtime used as the default in Kubernetes and under Docker Engine. NVD tracks it as linuxfoundation:containerd. Low-level OCI runtime escapes that overwrite host binaries are attributed to runc, not this product.

api usage

Querying containerd

product slugcontainerd
version format1.5.0, 1.7.29
bash
curl "https://api.attestd.io/v1/check?product=containerd&version=1.5.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

containerd 1.5.0 is affected by CVE-2021-41103 (insecure permissions on container rootfs) and CVE-2022-23648 (host file exposure via crafted image config). The response shows risk_state: "high".

json
{
  "product": "containerd",
  "version": "1.5.0",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": [
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": null,
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2021-32760",
    "CVE-2021-41103",
    "CVE-2021-43816",
    "CVE-2022-23471",
    "CVE-2022-23648",
    "CVE-2022-31030",
    "CVE-2023-25153",
    "CVE-2023-25173",
    "CVE-2024-25621",
    "CVE-2024-40635",
    "CVE-2025-64329"
  ],
  "cves": null,
  "max_epss": 0.27392,
  "last_updated": "2026-07-13T05:14:04.466232Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}
safe version

containerd 1.7.29 includes the upstream fixes for CVE-2021-43816, CVE-2022-23648, CVE-2024-40635, and CVE-2021-41103.

bash
curl "https://api.attestd.io/v1/check?product=containerd&version=1.7.29" \
  -H "Authorization: Bearer $ATTESTD_KEY"
notable cves

CVE history

containerd CVEs concentrate on mount labeling, image config parsing, and permission handling on the container root filesystem. Host binary overwrite escapes belong to runc (for example CVE-2024-21626), not containerd.

CVEDescriptionAffectsCVSS
CVE-2021-43816SELinux-enabled installs can be escaped via incorrect mount labeling.≥1.5.1 <1.5.99.1
CVE-2022-23648Specially crafted image config exposes host files via volume mounts.<1.4.13 / ≥1.5 <1.5.10 / ≥1.6 <1.6.17.5
CVE-2024-40635Containers with a User namespace directive can gain unexpected privileges.<1.6.38 / ≥1.7 <1.7.27 / ≥2.0 <2.0.47.8
CVE-2021-41103Insecure / permissions on container rootfs allow local privilege escalation.<1.4.11 / ≥1.5 <1.5.77.8
CVE-2023-25173Supplemental groups not dropped on exec, enabling privilege escalation.1.6.x before 1.6.187.8
related