StackRadar

CVE-2026-46680

High

Advisory

Published 21 May 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.8
base score, highest
EPSS
0.002
6th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
83
of 17,781 indexed, latest versions
Container images
85
deployed by those charts
Fix available
2 of 3
affected packages

containerd user ID handling bypass allows runAsNonRoot evasion

Carried by container images the latest versions of 83 of 17,781 indexed charts deploy, on 85 images.

Affected packageAffected versionsFixed inImages
github.com/containerd/containerdgolangv1.7.27, v1.7.28, v1.7.29, v1.7.30+1 more1.7.3269
github.com/containerd/containerd/v2golangv2.0.4, v2.1.1, v2.1.3, v2.1.4+6 more2.0.9, 2.2.4, 2.3.119
containerddeb1.6.20~ds1-1+deb12u3no fix listed1
OSV records
DEBIAN-CVE-2026-46680GHSA-fqw6-gf59-qr4w
Also known as
GO-2026-5378

Charts affected

83 by stars
ChartLatestAffected imagesRadar Score
monitoring-stackict-platformVerified publisher0.4.01 of 13See more

monitoring-stack ict-platform 0.4.0

1 of the 13 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
ghcr.io/grafana/alloy-operator:1.7.02ce23f948e02
github.com/containerd/containerd@v1.7.29
1.7.32

Open the chart page →

9,573
registry-container-webhookinnagoVerified publisher2.0.21 of 1See more

registry-container-webhook innago 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
ghcr.io/indeedeng/harbor-container-webhook:main45ca15fc294f
github.com/containerd/containerd@v1.7.27
1.7.32

Open the chart page →

591
k8s-dev-podk8s-dev-pod0.3.11 of 1See more

k8s-dev-pod k8s-dev-pod 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
github.com/containerd/containerd@v1.7.27
1.7.32

Open the chart page →

8,811
dockerdkarljorgensen0.1.01 of 1See more

dockerd karljorgensen 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
library/docker:28.5.2-dind2a232a42256f
github.com/containerd/containerd/v2@v2.1.4
2.2.4

Open the chart page →

2,034
installerkrateo2.7.11 of 2See more

installer krateo 2.7.1

1 of the 2 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/installer/installer:0.6.3a7e922ddac55
github.com/containerd/containerd@v1.7.29
1.7.32

Open the chart page →

3,236
kube-ovnkube-ovn-test1.14.01 of 1See more

kube-ovn kube-ovn-test 1.14.0

1 of the 1 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
kubeovn/kube-ovn:v1.14.06722b54eb5c0
github.com/containerd/containerd/v2@v2.1.3
2.2.4

Open the chart page →

4,940
kubestellar-consolekubestellar-consoleVerified publisher0.3.411 of 2See more

kubestellar-console kubestellar-console 0.3.41

1 of the 2 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
alpine/k8s:1.32.47e1e7d5b7a96
github.com/containerd/containerd@v1.7.27
1.7.32

Open the chart page →

4,439
kubestellar-uikubestellaruiVerified publisher0.1.11 of 4See more

kubestellar-ui kubestellarui 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
mavrick1/kubestellar-b:latest45ca0429a1d4
github.com/containerd/containerd@v1.7.27
1.7.32

Open the chart page →

4,763
lagoon-docker-hostlagoon-chartsVerified publisher0.7.01 of 1See more

lagoon-docker-host lagoon-charts 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
uselagoon/docker-host:v3.6.12c89ed939b8b
github.com/containerd/containerd/v2@v2.1.1
2.2.4

Open the chart page →

2,113
linkerd-preview-vizlinkerd-buoyantVerified publisher25.4.33 of 5See more

linkerd-preview-viz linkerd-buoyant 25.4.3

3 of the 5 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
ghcr.io/buoyantio/metrics-api:preview-25.4.32cef2a3f97da
github.com/containerd/containerd@v1.7.27
1.7.32
ghcr.io/buoyantio/tap:preview-25.4.3e02a8bd9e2c3
github.com/containerd/containerd@v1.7.27
1.7.32
ghcr.io/buoyantio/web:preview-25.4.33ee1b62aa111
github.com/containerd/containerd@v1.7.27
1.7.32

Open the chart page →

3,420
vcluster-headloftVerified publisher0.0.0-035ec6e1 of 2See more

vcluster-head loft 0.0.0-035ec6e

1 of the 2 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/kubernetes:v1.35.090097a08b87c
github.com/containerd/containerd@v1.7.28
1.7.32

Open the chart page →

1,269
agent-controlnewrelic0.0.921 of 1See more

agent-control newrelic 0.0.92

1 of the 1 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
newrelic/newrelic-agent-control-cli:0.48.01a448492b55a
github.com/containerd/containerd@v1.7.27
1.7.32

Open the chart page →

3,843
lensoci-ai-incubations0.1.141 of 16See more

lens oci-ai-incubations 0.1.14

1 of the 16 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
alpine/k8s:1.31.106dbe6f391eda
github.com/containerd/containerd@v1.7.27
1.7.32

Open the chart page →

17,070
onedevonedev11.9.01 of 1See more

onedev onedev 11.9.0

1 of the 1 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
1dev/server:11.9.0cd5b12fe5471
github.com/containerd/containerd/v2@v2.0.4
2.0.9

Open the chart page →

6,037
pro-builderopenfaas0.6.131 of 2See more

pro-builder openfaas 0.6.13

1 of the 2 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
ghcr.io/openfaasltd/pro-builder:0.6.06c17297f9098
github.com/containerd/containerd/v2@v2.2.3
2.2.4

Open the chart page →

2,726
kb-cloud-installeropenshift2.1.351 of 1See more

kb-cloud-installer openshift 2.1.35

1 of the 1 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
github.com/containerd/containerd@v1.7.29
1.7.32

Open the chart page →

4,127
operator-lifecycle-manageroperator-lifecycle-manager1.2.22 of 2See more

operator-lifecycle-manager operator-lifecycle-manager 1.2.2

2 of the 2 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
quay.io/operator-framework/catalogd:v1.8.06ff40fa6257f
github.com/containerd/containerd@v1.7.30
1.7.32
quay.io/operator-framework/operator-controller:v1.8.0bca5dfcc67ca
github.com/containerd/containerd@v1.7.30
1.7.32

Open the chart page →

1,821
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.01 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

1 of the 40 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
gcr.io/kaniko-project/executor:latest4e7a52dd1f14
github.com/containerd/containerd@v1.7.27
github.com/containerd/containerd/v2@v2.1.1
1.7.32
2.2.4

Open the chart page →

71,208
parcaparca-rr0.1.01 of 2See more

parca parca-rr 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
ghcr.io/parca-dev/parca-agent:v0.42.0adc0eeb4dd05
github.com/containerd/containerd@v1.7.27
1.7.32

Open the chart page →

2,366
tenant-namespace-operatorpnnl-miscscripts0.1.281 of 1See more

tenant-namespace-operator pnnl-miscscripts 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
github.com/containerd/containerd@v1.7.28
1.7.32

Open the chart page →

12,754
prismeai-appsprismeai0.7.11 of 4See more

prismeai-apps prismeai 0.7.1

1 of the 4 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
github.com/containerd/containerd@v1.7.29
1.7.32

Open the chart page →

2,751
prismeai-coreprismeai1.12.11 of 7See more

prismeai-core prismeai 1.12.1

1 of the 7 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
github.com/containerd/containerd@v1.7.29
1.7.32

Open the chart page →

3,270
rancher-auto-registerrancher-auto-registerVerified publisher0.1.01 of 1See more

rancher-auto-register rancher-auto-register 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
github.com/containerd/containerd@v1.7.27
1.7.32

Open the chart page →

1,837
devtron-enterpriseromholdings48.0.02 of 28See more

devtron-enterprise romholdings 48.0.0

2 of the 28 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
quay.io/devtron/chart-sync:94237c18-1021-3941960566529446a
github.com/containerd/containerd@v1.7.30
1.7.32
quay.io/devtron/kubelink:94237c18-314-394179d25865295af
github.com/containerd/containerd@v1.7.29
1.7.32

Open the chart page →

68,240
devtron-operatorromholdings0.23.32 of 11See more

devtron-operator romholdings 0.23.3

2 of the 11 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
quay.io/devtron/chart-sync:3b3d6d0e-836-39296721b5c9634d4
github.com/containerd/containerd@v1.7.30
1.7.32
quay.io/devtron/kubelink:09867a9c-564-39289ea6dd1e4ce71
github.com/containerd/containerd@v1.7.29
1.7.32

Open the chart page →

32,902
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
alpine/k8s:1.32.12048f8d9c8cc7
github.com/containerd/containerd@v1.7.28
1.7.32

Open the chart page →

5,819
act-runnertektonops0.1.21 of 2See more

act-runner tektonops 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
gitea/act_runner:nightly7940221bcfc9
github.com/containerd/containerd@v1.7.29
1.7.32

Open the chart page →

4,212
terminusterminusVerified publisher1.1.01 of 1See more

terminus terminus 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
ghcr.io/terminus-io/enforcer:v1.1.0f21b905610d6
github.com/containerd/containerd/v2@v2.2.2
2.2.4

Open the chart page →

631
orchestratremolo3.1.551 of 5See more

orchestra tremolo 3.1.55

1 of the 5 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
ghcr.io/headlamp-k8s/headlamp:v0.42.0c9754bae1d79
github.com/containerd/containerd@v1.7.30
1.7.32

Open the chart page →

7,637
trident-protecttrident-protect100.2606.01 of 2See more

trident-protect trident-protect 100.2606.0

1 of the 2 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
netapp/trident-protect-utils:v2.0.0cd0c18d8f9ec
github.com/containerd/containerd@v1.7.27
1.7.32

Open the chart page →

1,331
trident-protect-consoletrident-protect100.2608.0-console1 of 3See more

trident-protect-console trident-protect 100.2608.0-console

1 of the 3 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
netapp/trident-protect-utils:v2.0.0cd0c18d8f9ec
github.com/containerd/containerd@v1.7.27
1.7.32

Open the chart page →

1,322
traceetrivy-operator0.24.11 of 1See more

tracee trivy-operator 0.24.1

1 of the 1 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
aquasec/tracee:0.24.1cfbbfee972e6
github.com/containerd/containerd@v1.7.29
1.7.32

Open the chart page →

1,074
tfy-karpentertruefoundryVerified publisher0.5.111 of 3See more

tfy-karpenter truefoundry 0.5.11

1 of the 3 container images this version deploys carry CVE-2026-46680.

Container imageDigestPackageFixed in
public.ecr.aws/truefoundrycloud/eks/eks-node-monitoring-agent:v1.5.1-eksbuild.1988c8e1a273a
github.com/containerd/containerd@v1.7.30
1.7.32

Open the chart page →

645

Container images carrying it

85 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/clusternet/clusternet-scheduler:v1.0.0a6ae5aff81ce
github.com/containerd/containerd@v1.7.29
1.7.32
1
ghcr.io/comet-ml/opik/opik-python-backend:2.2.59269d0e55ea97
github.com/containerd/containerd/v2@v2.2.3
2.2.4
1
ghcr.io/devops-ia/steampipe:v2.4.1a982103d91d3
github.com/containerd/containerd@v1.7.29
1.7.32
1
ghcr.io/grafana/alloy-operator:1.3.02088dcb22aaa
github.com/containerd/containerd@v1.7.27
1.7.32
1
ghcr.io/grafana/alloy-operator:1.7.02ce23f948e02
github.com/containerd/containerd@v1.7.29
1.7.32
1
ghcr.io/grafana/alloy-operator:1.8.1ae85d68749c7
github.com/containerd/containerd@v1.7.29
1.7.32
1
ghcr.io/haedalwang/kubescout:0.1.107d51f838f0d
github.com/containerd/containerd@v1.7.29
1.7.32
1
ghcr.io/headlamp-k8s/headlamp:v0.42.0c9754bae1d79
github.com/containerd/containerd@v1.7.30
1.7.32
1
ghcr.io/helm/chartmuseum:v0.16.3c81f105c3682
github.com/containerd/containerd@v1.7.27
1.7.32
1
ghcr.io/helmfile/helmfile:v1.7.4f20e612d5a98
github.com/containerd/containerd@v1.7.27
1.7.32
1
ghcr.io/indeedeng/harbor-container-webhook:main45ca15fc294f
github.com/containerd/containerd@v1.7.27
1.7.32
1
ghcr.io/kagent-dev/kagent/tools:0.0.13c8882543f693
github.com/containerd/containerd@v1.7.28
1.7.32
1
ghcr.io/krateoplatformops/installer/installer:0.6.3a7e922ddac55
github.com/containerd/containerd@v1.7.29
1.7.32
1
ghcr.io/kubenetworks/kubevpn:v2.11.7cce8ff866f60
github.com/containerd/containerd@v1.7.27
1.7.32
1
ghcr.io/lockdep/stackradar-scanner:0.3.0dd8a35d50c2d
github.com/containerd/containerd/v2@v2.2.1
2.2.4
1
ghcr.io/loft-sh/kubernetes:v1.35.090097a08b87c
github.com/containerd/containerd@v1.7.28
1.7.32
1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.2035bc5ca66d55a
github.com/containerd/containerd@v1.7.27
1.7.32
1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.55d7f93d2182fe
github.com/containerd/containerd@v1.7.27
1.7.32
1
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--powerpipe:latesta16ab5ca10a7
github.com/containerd/containerd@v1.7.29
1.7.32
1
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--steampipe:latestc0c8d53df9f3
github.com/containerd/containerd@v1.7.29
1.7.32
1
ghcr.io/openfaasltd/pro-builder:0.6.06c17297f9098
github.com/containerd/containerd/v2@v2.2.3
2.2.4
1
ghcr.io/parca-dev/parca-agent:v0.42.0adc0eeb4dd05
github.com/containerd/containerd@v1.7.27
1.7.32
1
ghcr.io/terminus-io/enforcer:v1.1.0f21b905610d6
github.com/containerd/containerd/v2@v2.2.2
2.2.4
1
public.ecr.aws/datadog/agent:7.73.0f4925b15ce94
github.com/containerd/containerd@v1.7.29
1.7.32
1
public.ecr.aws/truefoundrycloud/eks/eks-node-monitoring-agent:v1.5.1-eksbuild.1988c8e1a273a
github.com/containerd/containerd@v1.7.30
1.7.32
1
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
github.com/containerd/containerd@v1.7.27
1.7.32
1
quay.io/gogatekeeper/gatekeeper:4.9.0dcf583aba224
github.com/containerd/containerd/v2@v2.3.0
2.3.1
1
quay.io/go-skynet/local-ai:latestd78cd113b2bc
github.com/containerd/containerd@v1.7.31
1.7.32
1
quay.io/manusa/kubernetes_mcp_server:v0.0.47150f76e844d9
github.com/containerd/containerd@v1.7.28
1.7.32
1
quay.io/nuclio/dashboard:1.17.8-amd64b5f5bd4efbee
github.com/containerd/containerd/v2@v2.2.3
2.2.4
1
quay.io/operator-framework/catalogd:v1.8.06ff40fa6257f
github.com/containerd/containerd@v1.7.30
1.7.32
1
quay.io/operator-framework/operator-controller:v1.8.0bca5dfcc67ca
github.com/containerd/containerd@v1.7.30
1.7.32
1
quay.io/opsmxpublic/opa:1.12.084fb1af7401c
github.com/containerd/containerd/v2@v2.2.0
2.2.4
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
github.com/containerd/containerd@v1.7.27
1.7.32
1
registry.gitlab.com/xrow-public/developer-operator/developer-operator-controller:2.1.2301847adfe16
github.com/containerd/containerd@v1.7.27
1.7.32
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.