7.8

CVE-2026-95837: containerd Improper Privilege Management

CVSS: 7.8v3.1HighAwaiting analysis
AliasesDEBIAN-CVE-2026-95837GHSA-p7v4-vr35-mj6fCGA-5cj6-ccvw-pcx6
Published 12-10-2026Last modified 13-10-2026
Open JSON

Vulnerability summary

CVE-2026-95837 is a high (CVSS 7.8) Improper Privilege Management vulnerability in containerd. EPSS estimates a 0.11% chance of exploitation in the next 30 days, higher than 1% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (NVD)
EPSS score
0.11%
0%100%
Low · Change unavailable
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 12-10-2026
    PublishedVulnerability first disclosed.
  2. 13-10-2026
    Last modifiedVulnerability information updated.

Description

containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a container from a crafted checkpoint can supply restored credentials, capabilities, no_new_privs, and seccomp state. The restored process can run as root with full capabilities and no enforced seccomp filters while CRI status reports the requested configuration. Systems that do not use CRI checkpoint restore are not affected. This issue is fixed in versions 2.2.7 and 2.3.4.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.11%

Chance of exploitation in the next 30 days

Percentile

1%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

13-10-202618-10-2026
EPSS score
0.11%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard9 products
  • containerd-2.1All versions (No fix recorded)
  • containerd-shim-runc-v2-2.1All versions (No fix recorded)
  • containerd-stress-2.1All versions (No fix recorded)
  • ctr-2.1All versions (No fix recorded)
  • datadog-agent-7.82All versions (No fix recorded)
Ubuntu3 products
  • containerdAll versions (No fix recorded)
  • containerd-appAll versions (No fix recorded)
  • containerd-stableAll versions (No fix recorded)
Containerd1 product
Debian1 product
  • containerdAll versions (No fix recorded)
Github.com/containerd/containerd1 product
  • v2≥ 2.1.0, < 2.2.7 | ≥ 2.3.0, < 2.3.4
Wolfi1 product
  • dockerd-28All versions (No fix recorded)

6 vendors · 16 products

References

9 links