An update for containerd is now available for openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3719 Final 1.0 1.0 2026-09-14 Initial 2026-09-14 2026-09-14 openEuler SA Tool V1.0 2026-09-14 containerd security update An update for containerd is now available for openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4 containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision, low-level storage and network attachments, etc. Security Fix(es): containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the Kubernetes runAsNonRoot restriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user. This issue has been fixed in versions 1.7.32, 2.0.9, 2.2.4 and 2.3.1.(CVE-2026-46680) An update for containerd is now available for openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High containerd https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3719 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-46680 https://nvd.nist.gov/vuln/detail/CVE-2026-46680 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 containerd-1.2.0-227.oe2003sp4.aarch64.rpm containerd-1.2.0-328.oe2203sp4.aarch64.rpm containerd-1.6.22-31.oe2403sp1.aarch64.rpm containerd-1.6.22-31.oe2403sp3.aarch64.rpm containerd-1.6.22-31.oe2403sp4.aarch64.rpm containerd-1.2.0-227.oe2003sp4.src.rpm containerd-1.2.0-328.oe2203sp4.src.rpm containerd-1.6.22-31.oe2403sp1.src.rpm containerd-1.6.22-31.oe2403sp3.src.rpm containerd-1.6.22-31.oe2403sp4.src.rpm containerd-1.2.0-227.oe2003sp4.x86_64.rpm containerd-1.2.0-328.oe2203sp4.x86_64.rpm containerd-1.6.22-31.oe2403sp1.x86_64.rpm containerd-1.6.22-31.oe2403sp3.x86_64.rpm containerd-1.6.22-31.oe2403sp4.x86_64.rpm containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the Kubernetes runAsNonRoot restriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user. This issue has been fixed in versions 1.7.32, 2.0.9, 2.2.4 and 2.3.1. 2026-09-14 CVE-2026-46680 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 High 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H containerd security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3719