[UPDATE] [high] Google Cloud Platform (GKE containerd): Multiple vulnerabilities
A remote, authenticated attacker can exploit multiple vulnerabilities in Google Cloud Platform to execute arbitrary program code, bypass security measures, manipulate data, disclose confidential information, or cause a denial-of-service condition.
CSIRTS triage
- What
- A remote, authenticated attacker can exploit multiple vulnerabilities in Google Cloud Platform to execute arbitrary program code, bypass security measures, manipulate data, disclose confidential information, or cause a denial-of-service condition.
- Who is affected
- Authenticated users of Google Cloud Platform (GKE containerd) are affected.
- Urgency
- Remediation is urgent due to the high severity and multiple attack vectors.
- Action
- Apply the latest patches from Google Cloud Platform to mitigate these vulnerabilities.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch GKE containerd
Get an email when a new GKE containerd advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2009
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-472620.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-501950.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-534880.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-534890.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-534920.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-47262 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-50195 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-53488 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-53489 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-53492 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownIssue with containerd CRI Plugin - CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47…aws
- criticalCVE-2026-53492: containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, t…nvd
- mediumCVE-2026-53489: containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 conta…nvd
- criticalCVE-2026-50195: containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 conta…nvd
- mediumCVE-2026-47262: containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5…nvd
- highCVE-2026-53488: containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1…nvd
- mediumGHSA-cvxm-645q-p574: containerd: CRI checkpoint import allows local image tag poisoningghsa
Recent advisories for Google Cloud Platform
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownCVE-2026-4644: A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors …nvd · 2026-09-04
- unknownCVE-2026-19410: An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Bui…nvd · 2026-08-31
- unknownCVE-2026-19485: A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI…nvd · 2026-08-26
- unknownCVE-2026-12717: An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud Bi…nvd · 2026-08-26
- unknownCVE-2026-15623: A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps (…nvd · 2026-08-17
- unknownCVE-2026-15587: Improper Privilege Management in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Go…nvd · 2026-08-05
More from CERT-Bund (BSI) Security Advisories
- medium[NEW] [medium] Langflow: Multiple vulnerabilities2026-09-04
- medium[NEW] [medium] Grafana Enterprise: Multiple vulnerabilities allow gaining user or administrator privileges2026-09-04
- low[NEW] [low] Checkmk: Vulnerability allows Denial of Service2026-09-04
- low[NEW] [low] ImageMagick: Multiple vulnerabilities allow Denial of Service2026-09-04
- critical[NEW] [critical] vm2: Multiple vulnerabilities allow code execution2026-09-04