fix(security/HIGH/): Update module github.com/containerd/containerd/v2 to v2.0.9 [SECURITY] (release-3.7.x) - #22187
Merged
rfratto merged 1 commit intoJun 8, 2026
Conversation
renovate-sh-app
Bot
changed the title
renovate-sh-app
Bot
deleted the
deps-update/release-3.7.x-security-github.comcontainerdcontainerdv2
branch
June 3, 2026 17:33
renovate-sh-app
Bot
changed the title
renovate-sh-app
Bot
force-pushed
the
deps-update/release-3.7.x-security-github.comcontainerdcontainerdv2
branch
2 times, most recently
from
June 4, 2026 17:18
2fbd89e to
f6c1756
Compare
…2 to v2.0.9 [SECURITY] | datasource | package | from | to | | ---------- | ----------------------------------- | ------ | ------ | | go | github.com/containerd/containerd/v2 | v2.0.7 | v2.0.9 | Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>
renovate-sh-app
Bot
force-pushed
the
deps-update/release-3.7.x-security-github.comcontainerdcontainerdv2
branch
from
June 8, 2026 17:14
f6c1756 to
6991f54
Compare
renovate-sh-app
Bot
changed the title
rfratto
approved these changes
Jun 8, 2026
This was referenced Jun 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.0.7→v2.0.9containerd user ID handling bypass allows runAsNonRoot evasion
CVE-2026-46680 / GHSA-fqw6-gf59-qr4w
More information
Details
Impact
A bug was found in containerd where containers launched with a numeric
Userdirective that cannot be parsed as a 32-bit integer are incorrectly treated as a username. If a crafted image provides an/etc/passwdfile mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the KubernetesrunAsNonRootrestriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user.Patches
This bug has been fixed in the following containerd versions:
Note: The containerd 2.1 release has reached its end of life and a fixed version is not provided.
Users should update to these versions to resolve the issue.
Workarounds
Ensure that only trusted images are used and that only trusted users have permissions to import images. Alternatively, enforcing a specific numeric
runAsUserin the Kubernetes PodsecurityContextoverrides theUSERdirective in the image and prevents the bypass. Newer versions of Kubernetes, starting with 1.34, also appear to enforcerunAsNonRootproperly regardless of this bug.Credits
The containerd project would like to thank Lei Wang (@ssst0n3) for responsibly disclosing this issue in accordance with the containerd security policy.
Resources
For more information
If there are any questions or comments about this advisory:
To report a security issue in containerd:
Severity
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
containerd/containerd (github.com/containerd/containerd/v2)
v2.0.9: containerd 2.0.9Compare Source
Welcome to the v2.0.9 release of containerd!
The ninth patch release for containerd 2.0 includes various bug fixes and updates, including a security fix.
containerd
Ensure container exit events are not lost during containerd restart (#11633)
Apply hardening to avoid TOCTOU race in tar extraction (#13237)
Fix handling of out-of-range USER values in OCI spec to avoid unexpected username/group lookups (#13449)
Apply hardening to block AF_ALG in default socket policy (#13407)
Support both "volatile" and "fsync=volatile" mount options for volatile snapshotter (#13298)
Fix bugs in sandbox service affecting sandbox creation configuration and event publishing (#13271)
Set AppArmor abi conditionally to support versions < 3.0 (#13277)
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
18 commits
2da65b8bdPrepare release notes for v2.0.91a3d1c85eoci: return explicit error for out-of-range USER valuesfa2a97505seccomp: Block AF_ALG in default socket policy4b2b07879seccomp: Document socket rule scope and socketcall limitationea56c9605Support both styles of volatile mount option3d34dc820sandbox: forward Create fields, fix event topics4b260843eapparmor: Set abi conditionally3e9c4d1e0Add GitHub Action for k8s node e2e testscf73e6873Fix TOCTOU race bug in tar extraction2320b319ecri:fix lost container exit events if they arrive before info is cachedThis release has no dependency changes
Previous release can be found at v2.0.8
containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.
See also the Getting Started documentation.
v2.0.8: containerd 2.0.8Compare Source
Welcome to the v2.0.8 release of containerd!
The eighth patch release for containerd 2.0 includes various bug fixes and updates, including a security fix.
Security Updates
Highlights
Container Runtime Interface (CRI)
Runtime
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
32 commits
c07b94f19Prepare release notes for v2.0.8 (missed line)c54b69f1aPrepare release notes for v2.0.8fde1480dfupdate github.com/moby/spdystream v0.5.15b2eee8a2update to Go 1.25.9, 1.26.2c579db16eupdate golangci-lint to v2.9.0 with go1.26 support185ddcfd0remove windows/arm from cross build8538158dfIgnore warnings for golangci-lint bump1cff32695ci: bump golangci from 6.5.2 to 7.0.02e02b8bb3Skip github.com/cyphar/filepath-securejoin license checkse71fc560bUpdating selinux to v1.13.1868869eb9fix: sanitize error before gRPC return to prevent credential leak in pod events40632e4f2fix: redact all query parameters in CRI error logs85c3b2b02CODEOWNERS: mark Sam and Chris as owners for 2.0902d804c9Update github.com/moby/spdystream v0.4.0->v0.5.0e92d7b131make linter happy in release12fc0e6caadd integration test for cni result nil8d912c6a2address comment742f8b8f6fix issue where cni del is never executedf24653597Ignore NOCHANGE error9c656fab4ci: update CIFuzz actions to support Ubuntu 24.04c71c4a091integration: Fix TestImageLoad() failure on CIbfee29999ci: modprobe xt_comment on almalinuxDependency Changes
Previous release can be found at v2.0.7
Which file should I download?
containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.
See also the Getting Started documentation.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
Need help?
You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.