UpHeron
All vulnerabilities

Servers and applications

CVE-2021-21334

containerd CRI plugin: environment variables can leak between containers

Severity
Medium 6.3
Published
5 Mar 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.3.10, 1.4.4
Also known as
GHSA-6g2q-w5j3-fwh4
Sources
NVD, Project advisories (GitHub)

Description

In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected…

Affected software

SoftwareAffected versions
containerdServers and applications · cpe:a:linuxfoundation:containerd
  • Every version before 1.3.10
  • From 1.4.0 before 1.4.4
containerdServers and applications · github:containerd/containerd
  • Version 1.4.0
  • Version 1.4.1
  • Version 1.4.2
  • Version 1.4.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-21334
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-21334
  • GitHub Advisory Database https://github.com/advisories/GHSA-6g2q-w5j3-fwh4
  • github.com https://github.com/containerd/containerd/security/advisories/GHSA-6g2q-w5j3-fwh4