A label is attacker input
containerd's CRI plugin passed labels from an image config straight into the container without validation, so a LABEL instruction written by whoever built the image could end up executed on the host by a plugin that consumes labels. Tracked as CVE-2026-53488 at CVSS 8.3; it does not require checkpoint or restore to be enabled.
A label line in a Dockerfile reached the host as a command.
Image metadata feels inert. A maintainer name, a build date, a description. Nothing that runs.
Every label you can read here was written by whoever built the image. It is ordinary text, shipped inside the image config, and it arrives before anything starts.
The container runtime copied those labels onto the container without checking them. Anything further along that reads labels and acts on them was handed attacker-controlled text.
The result was command execution on the host, from pulling an image. Scored eight point three, and it needed no checkpoint feature enabled.
Pulling is not a passive act. The metadata arrives first, and it is only as trustworthy as the person who built the image.
Update the runtime, and treat image metadata as untrusted input.
#linux#security#docker#kubernetes#devops
❯ exit 0