Privilege escalation in Containerd
CVE-2025-47291
containerd is an open-source container runtime. A bug was found in the containerd's CRI implementation where containerd, starting in version 2.0.1 and prior to version 2.0.5, doesn't put usernamespaced containers under the Kubernetes' cgroup hierarchy, therefore some Kubernetes limits are not honored. This may cause a denial of service of the Kubernetes node. This bug has been fixed in containerd 2.0.5+ and 2.1.0+. Users should update to these versions to resolve the issue. As a workaround, disable usernamespaced pods in Kubernetes temporarily.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.003 (18.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 18th percentile — 18.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.000
Affected products
- Containerd — versions >= 2.0.1, < 2.0.5
- Linuxfoundation Containerd
Weakness classification (CWE)
References
- github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ff (Vendor Advisory)
Frequently asked questions
- What is CVE-2025-47291?
- CVE-2025-47291 is a high-severity vulnerability in Containerd, classified under Incorrect Privilege Assignment. CVSS score: 7.5/10. Published 2025-05-21.
- How severe is CVE-2025-47291?
- High severity. CVSS v3 base score is 7.5 out of 10.