🛡️ CVE-2026-53489 on Go (Root.io) — containerd

Distribution advisory

This page covers CVE-2026-53489 as tracked by Go (Root.io), for the package containerd. The fix is available in version v2.2.4-aikido.1; earlier versions remain affected.

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is low, an attacker needs low-level privileges on the target. No user interaction is required. The scope is changed, meaning a successful attack can affect components beyond the vulnerable one. Rated impact: confidentiality high, integrity none, availability none. (rating taken from the base CVE record.)

CVSS metrics in full

The score comes from this vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

• Attack vector: Local — a local account, shell or session on the host is needed.
• Attack complexity: Low — the attack works reliably, with no preparation.
• Privileges required: Low — an ordinary user account is enough.
• User interaction: None — nobody has to be tricked into anything.
• Scope: Changed — a successful attack reaches components beyond the vulnerable one.
• Confidentiality impact: High — total loss, or loss the attacker controls.
• Integrity impact: None.
• Availability impact: None.

Weakness class

ROOT-APP-GOBINARY-CVE-2026-53489 is classified as CWE-61: UNIX Symbolic Link (Symlink) Following. The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere.

Affected software

ROOT-APP-GOBINARY-CVE-2026-53489 is recorded against 2 packages.

• github.com/containerd/containerd/v2 (fixed in v2.2.4-aikido.1)
• rootio-github.com/containerd/containerd/v2 (fixed in v2.2.4-root.io.1)

Timeline and source

Published on 2 July 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

Other advisories for this package

github.com/containerd/containerd/v2 has other advisories on record. If you are patching this one, these are worth checking on the same host:

• ROOT-APP-GOBINARY-CVE-2026-53492 (8.0 High, published 2 Jul 2026)
• ROOT-APP-GOBINARY-CVE-2026-53488 (8.0 High, published 2 Jul 2026)
• CVE-2026-50195 (published 25 Jun 2026)
• CVE-2026-53488 (8.0 High, published 25 Jun 2026)
• CVE-2026-53492 (8.0 High, published 22 Jun 2026)
• CVE-2026-47262 (published 19 Jun 2026)
• CVE-2026-53489 (8.0 High, published 19 Jun 2026)
• CVE-2026-46680 (8.0 High, published 21 May 2026)

Same weakness in other software

These advisories are the same class of weakness (CWE-61: UNIX Symbolic Link (Symlink) Following) in other software:

• CVE-2026-47763 (published 4 Aug 2026)
• CVE-2026-54574 (8.2 High, published 29 Jul 2026)
• CVE-2026-56748 (8.8 High, published 27 Jul 2026)
• CVE-2026-65010 (6.6 Medium, published 23 Jul 2026)
• CVE-2026-12080 (7.3 High, published 20 Jul 2026)
• CVE-2026-59674 (published 14 Jul 2026)
• CVE-2026-39822 (7.8 High, published 8 Jul 2026)
• CVE-2026-23968 (5.5 Medium, published 7 Jul 2026)

Details

Affected Packages

References