CVE-2026-53488 Exploit Metadata

PoC files

9 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-12

Technical assessment

Python exploit for CVE-2026-53488 that builds a malicious Docker image with reserved containerd labels, imports it into a vulnerable containerd instance, and triggers host-level command execution via the restart monitor's binary:// logger.

Backdoor review

No backdoor observed in reviewed code

The PoC demonstrates the claimed CVE-2026-53488 exploit by building a malicious Docker image with reserved containerd labels, importing it into a vulnerable containerd instance, and verifying host-level code execution via a marker file. All actions are consistent with the described vulnerability and no concealed, deceptive, or unrelated harmful behavior is present.

ClassificationExploit

Model confidence98%

AuthenticationNot required

Languagespythondockerfile

Target softwarecontainerd

Attack typescommand injectioncontainer escape

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a fully functional Python script that builds a malicious image, deploys a vulnerable containerd instance, and triggers host-level command execution via the binary:// logger. It is designed to exercise the vulnerability, not merely detect it, and includes a verification step that confirms code execution by checking for a marker file.

poc/poc.py:1-17poc/poc.py:233-297poc_verification_report.md:3-4

Requirements

Docker daemon accessible to build and run privileged containerspoc/poc.py:90-93poc/poc.py:120-132
Vulnerable containerd version (e.g., 2.3.1) running inside a privileged lab containerpoc/poc.py:111-116poc/poc.py:233-238
Malicious Docker image with containerd.io/restart.status and containerd.io/restart.loguri labelspoc/poc.py:65-81

Observed behavior

Builds a malicious Docker image containing reserved-namespace labels (containerd.io/restart.status, containerd.io/restart.loguri) with a binary:// payloadpoc/poc.py:65-108
Starts a privileged Docker container running the target containerd version and mounts the malicious image tarpoc/poc.py:111-155
Imports the malicious image into the nested containerd and creates a container, triggering label propagation to the containerpoc/poc.py:158-201
Waits for the restart monitor to execute the binary:// logger, creating a marker file (/tmp/CVE-2026-53488-pwned) as proof of host-level code executionpoc/poc.py:203-224
Verifies success by checking for the marker file and reports [SUCCESS] or [FAILED]poc/poc.py:270-289

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Marker File: /tmp/CVE-2026-53488-pwnedUsed to verify successful host-level code execution as part of the exploit demonstration.poc/poc.py:47-48poc/poc.py:74poc/poc.py:207-220
Payload: binary:///bin/sh?-c=echo+CVE-2026-53488-PWNED+>/tmp/CVE-2026-53488-pwnedThe exploit payload injected via a malicious Docker image label to achieve command execution on the host.poc/poc.py:74
Docker Image: cve-2026-53488-malicious:latestThe malicious Docker image built by the PoC to carry the exploit labels.poc/poc.py:82

Review boundaries

What the analysis did not establish

Evidence does not include the Dockerfile.vulnerable or lab/control images referenced in README.md; only the PoC script and verification report are provided.
The exploit runs inside a privileged Docker-in-Docker lab container, not directly on a production host; host-level execution is demonstrated within the nested environment.
The verification report states the fix evidence (label-skip warning) was not captured into artifacts.
Six unclassified files totaling 10770 bytes were not analyzed; their content is unknown and could theoretically contain unrelated behavior, though the text evidence shows no reference to them.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

CVE-2026-53488/docker-compose.yml

Created 2026-05-19Vuln labCVE-2026-53488Compose · mixed

1 Compose manifest · 1 Dockerfile · 1 service

Analysisdeepseek-v4-pro:cloud · 2026-08-12

Environment assessment

A privileged Docker container running a vulnerable containerd daemon (v2.3.1) with a restart monitor configured. The environment is designed to demonstrate CVE-2026-53488, where malicious image labels trigger host command execution via the containerd restart monitor's binary:// logger.

CVE-2026-53488/README.md:1-69CVE-2026-53488/docker-compose.yml:1-9CVE-2026-53488/Dockerfile.vulnerable:1-30

Lab assessment

Vulnerability lab

The README explicitly describes a vulnerability (CVE-2026-53488), provides a lab run instructions section, and the Dockerfile builds a vulnerable containerd version. The PoC script (poc.py) automates exploitation and verification, confirming the environment is a vulnerability research lab.

CVE-2026-53488/README.md:1-69CVE-2026-53488/poc/poc.py:1-297

Lab shapeCompose · mixed

Services1

Compose manifests1

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

target

vulnerable containerd daemonexploit target

A privileged Docker container built from Dockerfile.vulnerable, running containerd v2.3.1 with a restart monitor configured via config.toml. It serves as the nested daemon where the malicious image is imported and the exploit is triggered.

CVE-2026-53488/docker-compose.yml:2-9CVE-2026-53488/Dockerfile.vulnerable:1-30CVE-2026-53488/config.toml:1-8

poc.py

exploit automationverification script

A Python script that builds a malicious Docker image with reserved containerd labels, starts the lab container, imports the image into the nested containerd, creates a container, and checks for a marker file indicating successful host command execution.

CVE-2026-53488/poc/poc.py:1-297

config.toml

containerd configurationrestart monitor enabler

Configures containerd to use the native snapshotter and enables the restart monitor plugin with a 5-second interval, which is necessary for the exploit to trigger the binary:// logger.

CVE-2026-53488/config.toml:1-8

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-53488

Supported by supplied evidence

The README, PoC script, and verification report all describe and demonstrate the vulnerability: malicious image labels in the containerd.io namespace are propagated to a container, causing the restart monitor to execute an arbitrary binary on the host via the binary:// logger. The PoC creates a marker file as proof of host code execution.

CVE-2026-53488/README.md:1-69CVE-2026-53488/poc/poc.py:1-297CVE-2026-53488/poc_verification_report.md:1-27

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker must be installed on the host to build images and run privileged containers.CVE-2026-53488/README.md:47-48CVE-2026-53488/poc/poc.py:1-297
The lab image (cve-2026-53488-lab:local) must be built from Dockerfile.vulnerable with CONTAINERD_VERSION=2.3.1.CVE-2026-53488/README.md:47-48CVE-2026-53488/Dockerfile.vulnerable:1-30
The control image (cve-2026-53488-control:local) must be built for fixed-version testing.CVE-2026-53488/README.md:50-51
Python 3 must be available to run poc.py.CVE-2026-53488/poc/poc.py:1

Evidence-described exercise path

Build the lab image: docker build -f Dockerfile.vulnerable --build-arg CONTAINERD_VERSION=2.3.1 -t cve-2026-53488-lab:local .CVE-2026-53488/README.md:47-48
Build the control image: docker build -f Dockerfile.vulnerable --build-arg CONTAINERD_VERSION=2.3.2 -t cve-2026-53488-control:local .CVE-2026-53488/README.md:50-51
Run the exploit against the vulnerable version: python3 poc/poc.py 2.3.1CVE-2026-53488/README.md:53-55
Run the exploit against the fixed version (control): python3 poc/poc.py 2.3.2CVE-2026-53488/README.md:57-59

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own target (the nested containerd daemon). The PoC creates a marker file inside the lab container to prove host-level code execution, which is expected for demonstrating the vulnerability. No evidence of hidden, unnecessary, or external compromise, persistence, credential theft, or backdoor behavior is present.

CVE-2026-53488/poc/poc.py:1-297CVE-2026-53488/README.md:1-69

Review boundaries

What the analysis did not establish

The packet does not include the intel_brief.md, lab_build_report.md, or vulnerability_analysis.md files listed in the file inventory, so their content cannot be assessed.
The PoC script uses privileged mode and mounts the Docker socket implicitly via docker exec, which is necessary for the lab but could be risky if misused outside the intended environment.
The verification report mentions a marker file on the host, but the PoC checks for it inside the lab container; the exact boundary between host and container is blurred in the DinD setup.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

CVE-2026-53488