CVE-2021-21334
CVE-2021-21334 is a medium-severity vulnerability in Linuxfoundation Containerd with a CVSS 3.x base score of 6.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-668.
Key facts
- Severity: Medium (CVSS 3.x base score 6.3)
- CVSS v2: 4.3
- EPSS exploit prediction: 2% (79th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-668
- Affected product: Linuxfoundation Containerd
- Published:
- Last modified:
Description
In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions.
Frequently asked questions
- What is CVE-2021-21334?
- In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions.
- How severe is CVE-2021-21334?
- CVE-2021-21334 has a CVSS 3.x base score of 6.3, rated medium severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2021-21334 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (79th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2021-21334?
- CVE-2021-21334 primarily affects Linuxfoundation Containerd. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2021-21334?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2021-21334 published?
- CVE-2021-21334 was published on 2021-03-10 and last updated on 2026-06-17.
References
- https://github.com/containerd/containerd/commit/05f951a3781f4f2c1911b05e61c160e9c30eaa8e
- https://github.com/containerd/containerd/releases/tag/v1.3.10
- https://github.com/containerd/containerd/releases/tag/v1.4.4
- https://github.com/containerd/containerd/security/advisories/GHSA-6g2q-w5j3-fwh4
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KUE2Z2ZUWBHRU36ZGBD2YSJCYB6ELPXE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIBPKSX5IOWPM3ZPFB3JVLXWDHSZTTWT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VTXHA5JOWQRCCUZH7ZQBEYN6KZKJEYSD/
- https://security.gentoo.org/glsa/202105-33
Affected products (3)
- cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
More vulnerabilities in Linuxfoundation Containerd
- CVE-2026-50195 — Critical (CVSS 9.9): containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the…
- CVE-2026-53492 — Critical (CVSS 9.6): containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation…
- CVE-2026-53488 — High (CVSS 8.8): containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI…
- CVE-2021-43816 — High (CVSS 8.0): containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or…
- CVE-2026-46680 — High (CVSS 7.8): containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers…
- CVE-2021-41103 — High (CVSS 7.8): containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was…
All CVEs affecting Linuxfoundation Containerd →
Other CWE-668 (Exposure of Resource to Wrong Sphere) vulnerabilities
- CVE-2025-2857 — Critical (CVSS 10.0): Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in…
- CVE-2019-8779 — Critical (CVSS 10.0): A logic issue applied the incorrect restrictions. This issue was addressed by updating the logic to apply the correct…
- CVE-2012-1846 — Critical (CVSS 10.0): Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the sandbox protection mechanism by leveraging…
- CVE-2022-43684 — Critical (CVSS 9.9): ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow…
- CVE-2022-24900 — Critical (CVSS 9.9): Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer.…
- CVE-2019-16541 — Critical (CVSS 9.9): Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site…
Browse all CWE-668 (Exposure of Resource to Wrong Sphere) vulnerabilities →