GHSA-fqw6-gf59-qr4w

Suggest an improvement
Source
https://github.com/advisories/GHSA-fqw6-gf59-qr4w
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-fqw6-gf59-qr4w/GHSA-fqw6-gf59-qr4w.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-fqw6-gf59-qr4w
Aliases
Downstream
CGA (578)
ECHO (1)
MINI (164)
Published
2026-05-21T21:40:36Z
Modified
2026-09-10T03:51:05Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
  • 7.3 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
containerd user ID handling bypass allows runAsNonRoot evasion
Details

Impact

A bug was found in containerd where containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the Kubernetes runAsNonRoot restriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user.

Patches

This bug has been fixed in the following containerd versions:

  • 2.3.1
  • 2.2.4
  • 2.0.9
  • 1.7.32

Note: The containerd 2.1 release has reached its end of life and a fixed version is not provided.

Users should update to these versions to resolve the issue.

Workarounds

Ensure that only trusted images are used and that only trusted users have permissions to import images. Alternatively, enforcing a specific numeric runAsUser in the Kubernetes Pod securityContext overrides the USER directive in the image and prevents the bypass. Newer versions of Kubernetes, starting with 1.34, also appear to enforce runAsNonRoot properly regardless of this bug.

Credits

The containerd project would like to thank Lei Wang (@ssst0n3) for responsibly disclosing this issue in accordance with the containerd security policy.

Resources

For more information

If there are any questions or comments about this advisory:

To report a security issue in containerd:

Database specific 
{
    "cwe_ids":  [
        "CWE-269",
        "CWE-843"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-21T21:40:36Z",
    "nvd_published_at":  "2026-07-01T18:16:32Z",
    "severity":  "HIGH"
}
References

Affected packages

Go
github.com/containerd/containerd

Package

Name
github.com/containerd/containerd
View open source insights on deps.dev
Purl
pkg:golang/github.com/containerd/containerd

Affected ranges

Type
SEMVER
Events
Introduced
1.7.27
Fixed
1.7.32

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-fqw6-gf59-qr4w/GHSA-fqw6-gf59-qr4w.json"
github.com/containerd/containerd/v2

Package

Name
github.com/containerd/containerd/v2
View open source insights on deps.dev
Purl
pkg:golang/github.com/containerd/containerd/v2

Affected ranges

Type
SEMVER
Events
Introduced
2.0.4
Fixed
2.0.9

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-fqw6-gf59-qr4w/GHSA-fqw6-gf59-qr4w.json"
github.com/containerd/containerd/v2

Package

Name
github.com/containerd/containerd/v2
View open source insights on deps.dev
Purl
pkg:golang/github.com/containerd/containerd/v2

Affected ranges

Type
SEMVER
Events
Introduced
2.1.0-beta.0
Fixed
2.2.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-fqw6-gf59-qr4w/GHSA-fqw6-gf59-qr4w.json"
github.com/containerd/containerd/v2

Package

Name
github.com/containerd/containerd/v2
View open source insights on deps.dev
Purl
pkg:golang/github.com/containerd/containerd/v2

Affected ranges

Type
SEMVER
Events
Introduced
2.3.0-beta.0
Fixed
2.3.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-fqw6-gf59-qr4w/GHSA-fqw6-gf59-qr4w.json"