CVE-2026-46680 Details
Description
containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the Kubernetes runAsNonRoot restriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user. This issue has been fixed in versions 1.7.32, 2.0.9, 2.2.4 and 2.3.1.
A vulnerability in containerd, an open-source container runtime, allows for evasion of the runAsNonRoot restriction in Kubernetes. This issue is present in containerd versions prior to 1.7.32, 2.0.9, 2.2.4, and 2.3.1. The vulnerability arises when containers are launched with a numeric User directive that cannot be parsed as a 32-bit integer, leading to incorrect interpretation as a username. If a malicious image includes an /etc/passwd file that maps this large numeric string to root, the container will run as root (UID 0). This behavior is problematic for environments that require containers to operate as non-root users.
Users can update to containerd versions 1.7.32, 2.0.9, 2.2.4, or 2.3.1 to address this vulnerability. Additionally, ensuring that only trusted images are used and that only reliable users can import images can help mitigate the risk. For Kubernetes users, enforcing a specific numeric runAsUser in the Pod securityContext can override the USER directive in the image, preventing the bypass. Newer Kubernetes versions, starting with 1.34, also seem to properly enforce runAsNonRoot, regardless of this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linuxfoundation containerd | >= 1.7.27, < 1.7.32 >= 2.0.4, < 2.0.9 >= 2.1.0, < 2.2.4 >= 2.3.0, < 2.3.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 3, 2026 | CVE Modified | CISA-ADP |
| Jul 2, 2026 | Initial Analysis | [email protected] |
| Jul 2, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | [email protected] |