GCP-2026-061

In plain language

What this advisory means

A security weakness in the container runtime component called containerd allows specially crafted containers restored from untrusted checkpoints to bypass security settings and run with higher privileges than intended. By default, Google Kubernetes Engine (GKE) clusters are not affected because they do not include the required tool (criu). No immediate user action is needed unless you have installed custom runtime software or tools that include the criu binary. In that case, you should follow recommended actions in the security bulletin.

Technical explanation

How the issue affects the environment

The vulnerability exists in containerd's Container Runtime Interface (CRI) implementation, where restoring a container from an untrusted checkpoint via the CreateContainer API skips enforcing the destination security context. This bypass allows the container to execute with elevated privileges, potentially leading to privilege escalation. GKE clusters are unaffected by default as their node images omit the checkpoint/restore (criu) tool needed to exploit this issue. The reported vulnerability is tracked under GHSA-p7v4-vr35-mj6f with CVE assignment pending. Users running custom container runtimes or node software containing the criu binary should review the relevant Google Kubernetes Engine security bulletin for remediation steps.

Operational impact

Why teams should care

If exploited, this vulnerability could allow attackers to escape container security boundaries and gain higher privileges on the host system, increasing the risk of unauthorized access or control of resources. For environments using default GKE clusters, the risk is minimal as the necessary tools to exploit the flaw are not included. However, custom setups that include the criu tool may be vulnerable and should address this promptly to avoid potential compromise.

Affected and fixed releases

Temporary risk reduction

No specific workaround is provided. Avoid using untrusted checkpoints for container restoration or remove the criu tool from your node images to prevent exploitation. Using default GKE clusters is protective since they do not include the criu binary by default.

Evidence and validation checklist

• Containerd's CRI implementation vulnerability allows privilege bypass when restoring containers from untrusted checkpoints via CreateContainer API.
• GKE clusters are not vulnerable by default since criu tool is not included in node images.
• No immediate action required for standard GKE clusters.
• Custom runtimes or nodes with criu must refer to security bulletin for mitigation guidance.
• Vulnerability tracked as GHSA-p7v4-vr35-mj6f; CVE assignment pending.