All Products
Search

This Product

    Container Service for Kubernetes:CVE-2021-41103 Security Advisory

    Document Center

    Container Service for Kubernetes:CVE-2021-41103 Security Advisory

    Last Updated:Aug 25, 2026

    The containerd community disclosed security vulnerability CVE-2021-41103. This vulnerability stems from a bug in containerd. If containers lack proper permission constraints on their root directories and for certain system extensions, an unprivileged Linux user on the host can traverse the container file system and execute programs.

    CVE-2021-41103 is rated medium severity with a CVSS score of 5.9.

    Scope of Impact

    The following containerd versions are affected:
    • <v1.4.11
    • <v1.5.7
    The containerd community fixed this vulnerability in the following versions:
    • v1.4.11
    • v1.5.7

    For more information, see CVE-2021-41103.

    Impact

    In multi-tenant scenarios, if containers on cluster nodes have extended permissions, such as setuid, an unprivileged Linux user can discover and execute those programs. If an unprivileged host Linux user’s UID matches the UID or GID of the program owner inside the container, that user can read and write the file. This leads to privilege escalation.

    Mitigation

    1. You must ensure that only trusted users can log on to cluster nodes. You must restrict access to cluster nodes for untrusted users.
    2. You must remove unnecessary extended permissions from container bundle directories.