Hi,

The following vulnerability was published for containerd.

CVE-2026-46680[0]:
| containerd is an open-source container runtime. In versions prior to
| 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric
| User directive that cannot be parsed as a 32-bit integer are
| incorrectly treated as a username, leading to runAsNonRoot evasion.
| If a crafted image provides an /etc/passwd file mapping this large
| numeric string to root, the container ultimately runs as root (UID
| 0). This allows the Kubernetes runAsNonRoot restriction to be
| bypassed, causing unexpected behavior for environments that require
| containers to run as a non-root user. This issue has been fixed in
| versions 1.7.32, 2.0.9, 2.2.4 and 2.3.1.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-46680
https://www.cve.org/CVERecord?id=CVE-2026-46680
[1] https://github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

containerd in unstable/testing is not affected by CVE-2026-46680.

Upstream backported the fix for GHSA-fqw6-gf59-qr4w [1] (commit 2054cc54c,
PR #13497 [2]) to release/2.1, which was released in v2.1.8 and v2.1.9. Debian
packaged v2.1.9 as 2.1.9+ds1-1, so unstable is fine.

Closing with version 2.1.9+ds1-1 to update BTS version tracking for sid/forky.
The bug remains tracked for trixie/bookworm via the 1.7.24~ds1-1 found marker.

[1] https://github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w
[2] https://github.com/containerd/containerd/pull/13497

Hi Reinhard,

Uh that is odd, because when I checked I think to had considered the
statement:

But looking at the fixes for the oldes version the only canidate
sensible looks to be
https://github.com/containerd/containerd/commit/6a05ddd119ec81beb36d504ce844bdd11bfcb22c
(v1.7.32), and then this would indeed match
https://github.com/containerd/containerd/commit/2054cc54c101831e44c83b4185e1e3d09ff50840
which *was* tagged.

So is the upstream information in the GHSA wrong, and do we have the
right mapping?

Regards,
Salvatore