CVE-2026-50195: containerd CRI checkpoint import RCE
CVE-2026-50195 is verified against the affected target vulnerability class: RCE This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00248.
pruva-verify REPRO-2026-00248 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00248/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh containerd before 2.3.2, 2.2.5, and 2.1.9 fails to validate image references in a CRI checkpoint image's configuration. An attacker can craft a checkpoint image that pulls arbitrary images during import, leading to remote code execution on the host. Reproduce: build containerd from a vulnerable version, create a malicious checkpoint image with an attacker-controlled image reference, and use the CRI checkpoint import API to import it. The host will pull and run the attacker image.
Variant analysis
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.