[UPDATE] [high] Google Cloud Platform (GKE containerd): Multiple vulnerabilities
A remote, authenticated attacker can exploit multiple vulnerabilities in Google Cloud Platform to execute arbitrary program code, bypass security measures, manipulate data, disclose confidential information, or cause a denial-of-service condition.
CSIRTS triage
- What
- A remote, authenticated attacker can exploit multiple vulnerabilities in Google Cloud Platform to execute arbitrary program code, bypass security measures, manipulate data, disclose confidential information, or cause a denial-of-service condition.
- Who is affected
- Authenticated users of Google Cloud Platform (GKE containerd) are affected.
- Urgency
- Remediation is urgent due to the high severity and multiple attack vectors.
- Action
- Apply the latest patches from Google Cloud Platform to mitigate these vulnerabilities.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch GKE containerd
Get an email when a new GKE containerd advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2009
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-472620.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-501950.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-534880.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-534890.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-534920.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-47262 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-50195 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-53488 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-53489 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-53492 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownIssue with containerd CRI Plugin - CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47…aws
- criticalCVE-2026-53492: containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, t…nvd
- mediumCVE-2026-53489: containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 conta…nvd
- criticalCVE-2026-50195: containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 conta…nvd
- mediumCVE-2026-47262: containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5…nvd
- highCVE-2026-53488: containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1…nvd
- mediumGHSA-cvxm-645q-p574: containerd: CRI checkpoint import allows local image tag poisoningghsa
Recent advisories for Google Cloud Platform
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownCVE-2026-15623: A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps (…nvd · 2026-08-17
- unknownCVE-2026-15587: Improper Privilege Management in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Go…nvd · 2026-08-05
- high[NEW] [high] Google Cloud Platform: Vulnerability Allows Cross-Site Scriptingcert-bund · 2026-07-27
- unknownCVE-2026-12715: Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google C…nvd · 2026-07-17
- high[NEW] [high] Google Cloud Platform (BigQuery, Dataform, Colab Enterprise): Vulnerability allows privilege esca…cert-bund · 2026-07-14
- unknownCVE-2026-12879: An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions pri…nvd · 2026-07-09
More from CERT-Bund (BSI) Security Advisories
- high[NEW] [high] Linux Kernel: Multiple vulnerabilities2026-08-25
- medium[NEW] [medium] libTIFF: Multiple Vulnerabilities2026-08-25
- high[NEW] [high] Contao: Multiple Vulnerabilities2026-08-25
- medium[NEW] [medium] Django: Multiple Vulnerabilities2026-08-25
- high[NEW] [high] Red Hat Enterprise Linux (Apicurio Registry): Multiple Vulnerabilities2026-08-25