Skip to content

Known issues#

This section describes the MSR known issues with available workarounds, along with a list of current product limitations:

Critical CVEs in MSR 2.10 component images#

Security scans of MSR 2.10 might report the following critical vulnerabilities in product component images.

Component Vulnerability CVE Installed version Fixed version
dtr-postgres libcrypto3 (OS package) CVE-2026-34182 3.5.6-r0 3.5.7-r0
dtr-postgres libssl3 (OS package) CVE-2026-34182 3.5.6-r0 3.5.7-r0
dtr-* github.com/containerd/containerd (Go module) CVE-2026-53488 v1.7.12 v1.7.33

These findings present low practical risk for typical MSR deployments:

  • The libcrypto3 and libssl3 packages are present in the dtr-postgres image. This image is not exposed to external networks.
  • MSR uses the containerd dependency as a library for image manifest handling. MSR does not run a containerd daemon, so the CRI code path affected by CVE-2026-53488 does not run.

Resolution

Mirantis plans to address these CVEs in a future release.