---
id: "CVE-2026-95837"
kind: "vulnerability"
aliases: ["CVE-2026-95837", "GHSA-p7v4-vr35-mj6f", "GO-2026-6791"]
title: "containerd CRI plugin: Checkpoint restore bypasses destination security context in github.com/containerd/containerd"
severity: "high"
cvss: 7.8
epss: 0.00106
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "github.com/containerd/containerd", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "github.com/containerd/containerd/v2", "fixed": ["2.2.7", "2.3.4"], "affected": ">= 2.3.0, < 2.3.4", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["container-runtime", "containerd", "infrastructure", "kubernetes", "self-hosted"]
not_affected_if: ["default-config", "no-checkpoint-restore"]
published_at: "2026-10-12T20:17:10+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T19:52:54+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6791", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-95837", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95837", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# containerd CRI plugin: Checkpoint restore bypasses destination security context in github.com/containerd/containerd

containerd's CRI plugin restores container security state (user, capabilities, no_new_privs, seccomp) from a checkpoint instead of the requested container config. An attacker who can create a container from a crafted checkpoint can get a root process with full capabilities and no seccomp filter.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/containerd/containerd affected all versions fixed ?
- go:github.com/containerd/containerd/v2 affected >= 2.3.0, < 2.3.4 fixed 2.2.7, 2.3.4

## How to check

Check whether the containerd version is 2.1.0 through 2.2.6 or 2.3.0 through 2.3.3 (run containerd --version); check whether CRI checkpoint restore is used (CreateContainer with a checkpoint image).

## Fix

Upgrade containerd to 2.2.7 or 2.3.4. Go module users of github.com/containerd/containerd/v2 should move to those versions.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6791
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-95837
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95837

## From the sources

containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a container from a crafted checkpoint can supply restored credentials, capabilities, no_new_privs, and seccomp state. The restored process can run as root with full capabilities and no enforced seccomp filters while CRI status reports the requested configuration. Systems that do not use CRI checkpoint restore are not affected. This issue is fixed in versions 2.2.7 and 2.3.4.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_