# CVE-2026-95837: containerd CRI plugin checkpoint restore privilege bypass

Source: https://junglewise.ai/threats/cve-2026-95837-containerd-cri-plugin-checkpoint-restore-bypasses-destination  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-15  
License: CC BY 4.0 with a link back

CVE-2026-95837 · Severity: high · CVSS 7.8 · Published 2026-10-12

containerd is a container runtime that orchestrates application containers across Linux systems. A flaw in its checkpoint restore feature allows an attacker to run a container with elevated privileges and bypass security policies set by the orchestrator, potentially leading to unauthorized root access and capability escalation. Containers restored from untrusted checkpoints can execute with full capabilities and no security restrictions despite administrators' intent.

Technologies: [Containerd](https://junglewise.ai/threats/technologies/containerd), [github.com/containerd/containerd (Go)](https://junglewise.ai/threats/technologies/github-com-containerd-containerd), [github.com/containerd/containerd/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-containerd-containerd-v2). Vendors: [Containerd](https://junglewise.ai/threats/vendors/containerd), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-95837 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95837 being exploited in the wild.

**How severe is CVE-2026-95837?** High severity, with a CVSS score of 7.8, published 12 October 2026.

**Which products and versions are affected?** Containerd before 2.2.7, 2.3.x before 2.3.4; github.com/containerd/containerd (Go) SEMVER:introduced=0; github.com/containerd/containerd/v2 (Go) >= 2.1.0, < 2.2.7, SEMVER:introduced=2.1.0,fixed=2.2.7, SEMVER:introduced=2.1.0,fixed=2.2.7,introduced=2.3.0,fixed=2.3.4.

**Is there a fix for CVE-2026-95837?** Yes. github.com/containerd/containerd/v2 (Go): upgrade to 2.2.7, 2.3.4 or later. Until then: Disable checkpoint restore via CreateContainer by updating to patched versions; if the feature is required, restrict container creation permissions to trusted users and validate container image registries or use admission controllers to reject images containing checkpoint data. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-95837 attacked?** It is attacked with local access or over the network, in a software library.

**Am I affected by CVE-2026-95837?** Check whether you run Containerd, github.com/containerd/containerd (Go) or github.com/containerd/containerd/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/containerd/containerd/v2 (Go): upgrade to 2.2.7, 2.3.4 or later

  ```sh
  go get github.com/containerd/containerd/v2@v2.3.4
  ```


Disable checkpoint restore via CreateContainer by updating to patched versions; if the feature is required, restrict container creation permissions to trusted users and validate container image registries or use admission controllers to reject images containing checkpoint data.

## Technical details

When restoring a container from a checkpoint via the CreateContainer API, containerd's CRI implementation uses CRIU to restore process credentials, capabilities, no_new_privs, and seccomp state directly from checkpoint data instead of enforcing the destination security context. An authenticated attacker with container creation permissions can supply a crafted checkpoint image to execute processes as root with full capabilities. The CRI status reporting also masks this discrepancy by reflecting requested rather than actual process state.

## Affected products

- containerd containerd before 2.2.7, 2.3.x before 2.3.4

## Identifiers

- CVE-2026-95837
- GHSA-p7v4-vr35-mj6f
- GO-2026-6791

## Timeline

- 2026-10-15: disclosed

## Related threats

- [containerd layer unpack denial of service via opaque whiteouts](https://junglewise.ai/threats/cve-2026-95838-containerd-unpack-dos-via-repeated-opaque-whiteouts)
- [Containerd image-pull denial of service via OCI index graph amplification](https://junglewise.ai/threats/cve-2026-53493-containerd-image-pull-denial-of-service-via-oci-index-graph)
- [containerd CRI ExecSync goroutine leak denial of service](https://junglewise.ai/threats/cve-2026-53495-containerd-cri-execsync-goroutine-leak-denial-of-service)
- [containerd CRI security context bypass in checkpoint restore](https://junglewise.ai/threats/containerd-cri-security-context-bypass-in-checkpoint-restore-d7cf36e0)
- [containerd CDI annotation smuggling during CRI checkpoint restore](https://junglewise.ai/threats/cve-2026-53492-containerd-cdi-annotation-smuggling-during-cri-checkpoint-restore)