CVE-2021-32760

containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with specific files.

• CWE-668
• CWE-732

• https://github.com/containerd/containerd/releases/tag/v1.4.8Release Notes, Third Party Advisory
• https://github.com/containerd/containerd/releases/tag/v1.5.4Release Notes, Third Party Advisory
• https://github.com/containerd/containerd/security/advisories/GHSA-c72p-9xmj-rx3wThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDMNDPJJTP3J5GOEDB66F6MGXUTRG3Y3/
• https://security.gentoo.org/glsa/202401-31
• https://github.com/containerd/containerd/releases/tag/v1.4.8Release Notes, Third Party Advisory
• https://github.com/containerd/containerd/releases/tag/v1.5.4Release Notes, Third Party Advisory
• https://github.com/containerd/containerd/security/advisories/GHSA-c72p-9xmj-rx3wThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDMNDPJJTP3J5GOEDB66F6MGXUTRG3Y3/
• https://security.gentoo.org/glsa/202401-31

Published

Jul 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32753EdgeX Foundry is an open source project for building a commo…6.5
• CVE-2021-32754FlowDroid is a data flow analysis tool. FlowDroid versions p…5.3
• CVE-2021-32755Wire is a collaboration platform. wire-ios-transport handles…4.3
• CVE-2021-32756ManageIQ is an open-source management platform. In versions …8.8
• CVE-2021-32758OpenMage Magento LTS is an alternative to the Magento CE off…7.2
• CVE-2021-32759OpenMage magento-lts is an alternative to the Magento CE off…7.2
• CVE-2021-32761Redis is an in-memory database that persists on disk. A vuln…7.5
• CVE-2021-32762Redis is an open source, in-memory database that persists on…8.8
• CVE-2021-32763OpenProject is open-source, web-based project management sof…6.5
• CVE-2021-32764Discourse is an open-source discussion platform. In Discours…5.4
• CVE-2021-32765Hiredis is a minimalistic C client library for the Redis dat…8.8
• CVE-2021-32766Nextcloud Text is an open source plaintext editing applicati…5.3