GCP-2026-061
Cybersecurity Classified by Officially
Published: 2026-09-09
Description
Description Severity NotesA security vulnerability (GHSA-p7v4-vr35-mj6f, CVE assignment pending) in containerd's CRI implementation allows a container restored from an untrusted checkpoint through the CreateContainer API to bypass the destination security context and execute with elevated privileges.
GKE clusters are not vulnerable by default. GKE node images do not include the criu tool.
What should I do?
No immediate customer action is required for default clusters. If you install custom runtime software or node tools on your nodes that include the criu binary, refer to the security bulletin for recommended actions.
What vulnerabilities are being addressed?
For more information, see the GKE security bulletin.
MediumThis is an extract. The publication continues at the source.
Read the original at the source: https://docs.cloud.google.com/support/bulletins/index#gcp-2026-061
Officially imported this from Google’s own source and shows an extract. If you work there, claiming the profile and verifying the domain lets you choose to show the full text here.
This publication has changed since it was first published
4 versions recorded. The original is kept in full — nothing is overwritten.
- v4 imported change on current
- v3 imported change on
- v2 imported change on
- v1 as first published on
Provenance
- Organization
- Google — imported from official source
- Official source
- https://cloud.google.com/feeds/google-cloud-security-bulletins.xml RSS
- Imported
- September 15, 2026 20:57
- Versions
- 4 recorded
- Identity
tag:google.com,2016:google-cloud-security-bulletins#gcp-2026-061