CVE-2026-95837

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-95837
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-95837.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-95837
Aliases
  • GHSA-p7v4-vr35-mj6f
Downstream
Published
2026-10-12T19:37:49Z
Modified
2026-10-14T02:48:29Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
containerd CRI plugin: Checkpoint restore bypasses destination security context
Details

containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a container from a crafted checkpoint can supply restored credentials, capabilities, no_new_privs, and seccomp state. The restored process can run as root with full capabilities and no enforced seccomp filters while CRI status reports the requested configuration. Systems that do not use CRI checkpoint restore are not affected. This issue is fixed in versions 2.2.7 and 2.3.4.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-269"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95837.json"
}
References

Affected packages

Git / github.com/containerd/containerd

Affected ranges

Type
GIT
Repo
https://github.com/containerd/containerd
Events
Introduced
061792f0ecf3684fb30a3a0eb006799b8c6638a7
Introduced
2976f38ccbfcda5ef1364d63d60b0a304e4bf94a
Fixed
7835c8dfefceee63b1a4f9e84e015ddc8434fdc3
Fixed
db8809540e1a7a9da5d518876894933ff55692ab
Fixed
928c03c6898cad95f795300281fdff0dbc55a32f
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2.1.0"
        },
        {
            "fixed":  "2.2.7"
        },
        {
            "introduced":  "2.3.0"
        },
        {
            "fixed":  "2.3.4"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

api/v1.*
api/v1.10.0
api/v1.10.0-beta.0
api/v1.10.0-beta.1
api/v1.10.0-rc.0
api/v1.11.1
v2.*
v2.1.0
v2.2.0
v2.2.0-beta.0
v2.2.0-beta.1
v2.2.0-beta.2
v2.2.0-rc.0
v2.2.0-rc.1
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.3.0
v2.3.1
v2.3.2
v2.3.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-95837.json"