Hi,

The following vulnerability was published for containerd.

CVE-2026-46680[0]:
| containerd is an open-source container runtime. In versions prior to
| 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric
| User directive that cannot be parsed as a 32-bit integer are
| incorrectly treated as a username, leading to runAsNonRoot evasion.
| If a crafted image provides an /etc/passwd file mapping this large
| numeric string to root, the container ultimately runs as root (UID
| 0). This allows the Kubernetes runAsNonRoot restriction to be
| bypassed, causing unexpected behavior for environments that require
| containers to run as a non-root user. This issue has been fixed in
| versions 1.7.32, 2.0.9, 2.2.4 and 2.3.1.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-46680
https://www.cve.org/CVERecord?id=CVE-2026-46680
[1] https://github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore