Package
rancher-2.13
Component
github.com/containerd/containerd
Latest update
7.8
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
CVE-2026-95837 (GHSA-p7v4-vr35-mj6f, GO-2026-6791) is a defect in containerd's CRI plugin. A container restored from an untrusted checkpoint via the CreateContainer API bypasses the destination CRI ContainerConfig, because CRIU restores process credentials, Linux capabilities, no_new_privs and seccomp state from the checkpoint data rather than enforcing the requested security context. Upstream states the issue affects Linux systems running containerd with CRI checkpoint restore enabled, and that users not utilizing CRI checkpoint restore are not affected.
This artifact vendors github.com/containerd/containerd as a client library for image and registry operations. It does not run the containerd daemon, does not serve the CRI API and does not expose checkpoint restore, so the affected CreateContainer and CRIU restore path is not reachable here.
The detected component is github.com/containerd/containerd@v1.7.36. The fix exists only on the github.com/containerd/containerd/v2 module line (2.2.7 and 2.3.4); the v1 module path is listed as affected from 0 with no fixed release, so no in-stream bump is available in any case.
Status