AIKIDO-2026-10353
github.com/containerd/containerd/v2 is vulnerable to Generation of Error Message Containing Sensitive Information
30
Low Risk
This Affects:
github.com/containerd/containerd/v2TL;DR
Affected versions of this package improperly sanitize container runtime errors due to the SanitizeError call being executed inside a defer, causing Go to evaluate errgrpc.ToGRPC(err) before sanitization occurs. As a result, the gRPC error returned to kubelet may contain sensitive information such as SAS tokens embedded in image pull URLs. An attacker with access to Kubernetes pod events (e.g., via kubectl describe pod) could trigger image pull failures and observe the resulting error messages to harvest exposed credentials from the unsanitized gRPC response.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
github.com/containerd/containerd/v2 is vulnerable to Generation of Error Message Containing Sensitive Information in versions 2.0.0 - 2.2.1.
How to fix this
Upgrade the github.com/containerd/containerd/v2 library to the patch version.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant