Package
falco-no-driver
Component
github.com/containerd/containerd/v2
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
GHSA-cvxm-645q-p574 (CVE-2026-50195) is present in the prebuilt Falco 'container' plugin (/usr/share/falco/plugins/libcontainer.so), which statically links github.com/containerd/containerd/v2 v2.1.5 (vulnerable < 2.1.9). Falco 0.44.1 downloads this plugin as a prebuilt binary (container-0.7.1 from download.falco.org) rather than building it from source, so the melange bump pipeline cannot remediate it. Upstream falcosecurity/plugins has no release with a patched containerd: both the latest release (plugins/container/v0.7.1) and the main branch still pin containerd/v2 v2.1.5 as a direct dependency (first patched 2.1.9). Pending an upstream container-plugin release that bumps containerd/v2 to >=2.1.9 and a corresponding prebuilt plugin consumed by Falco. No upstream fix date announced. Sibling advisory GO-2026-5758/CVE-2026-53488 (same 2.1.9 fix) was likewise unfixable and handled on main via an epoch-only bump.
Status