Listen to this Post
Technical Overview of CVE-2026-95837
A critical security vulnerability in containerd’s Container Runtime Interface (CRI) implementation allows processes running inside a restored container to completely bypass the destination security context configured by the orchestrator (such as Kubernetes).
When a container is started from a checkpoint archive or an annotated OCI image, the process restore operation relies on CRIU (Checkpoint/Restore in Userspace). During execution, CRIU restores process credentials (UID/GID), Linux capabilities, `no_new_privs` flags, and seccomp profiles directly from the state stored inside the untrusted checkpoint payload rather than enforcing the security boundaries specified in the destination CRI ContainerConfig.
As a result, an attacker capable of deploying a container with a specially crafted checkpoint payload can force the containerized process to run with full root privileges, elevated Linux capabilities, and no seccomp filtering—regardless of restrictive Pod Security Standards or SecurityContext policies declared in the manifest. Furthermore, containerd’s CRI status reporting reflects the requested security context rather than the actual state of the restored process, masking the privilege escalation from Kubernetes control planes and admission controllers.
DailyCVE Form:
Platform: containerd
Version: 2.1.0-2.3.3
Vulnerability: Privilege Escalation
Severity: Critical
date: September 2026
Prediction: Patch Released
What Undercode Say
Analytics
The vulnerability stems from a fundamental trust mismatch between the orchestration layer’s policy definition (ContainerConfig) and the low-level process state restoration engine (CRIU). Because CRIU operates by faithfully restoring the serialized process execution state from the image payload, setting standard Linux security controls after process creation cannot override the restored process attributes without breaking CRIU functionality. The issue is further compounded by status masking, where inspection APIs return the theoretical configuration rather than the running process flags from /proc.
Verification Commands
To check if a running process on a node has bypassed expected security context settings, security operators can inspect the kernel status directly on the host node:
Obtain the PID of the target container process
PID=$(crictl inspect <container_id> | grep -m1 '"pid"' | awk '{print $2}' | tr -d ',')
Check effective capabilities, UIDs, and seccomp status directly from the host kernel
grep -E '^(Uid|CapEff|NoNewPrivs|Seccomp):' /proc/$PID/status
Exploit: (Educational Purposes!)
Sorry, I cannot fulfill requests to generate or demonstrate actionable exploitation code or steps for bypassing security controls. I can, however, explain the theoretical mechanism behind the vulnerability or discuss defensive strategies to detect and mitigate it.
The theoretical vector involves an attacker crafting an OCI image containing a pre-existing CRIU checkpoint. Within this checkpoint, the process state metadata is edited to reflect full `CapEff` capability sets, UID 0, and `Seccomp: 0` (disabled). When the container runtime restores the process via CreateContainer, the CRI layer executes CRIU to recreate the process tree, which restores those high-privilege kernel flags directly into the process control block, bypassing orchestrator restrictions.
Protection
To protect systems against CVE-2026-95837:
- Upgrade containerd: Update to version 2.2.7, 2.3.4, or 2.4.0+. In versions 2.2.7 and 2.3.4, checkpoint restoration via `CreateContainer` is disabled by default. In 2.4.0, the legacy restoration path is removed entirely.
- Keep Experimental Restore Disabled: Do not set `enable_experimental_restore_via_create = true` in
config.toml, as doing so re-exposes the vulnerability. - Registry and Image Controls: Restrict container deployments to trusted registries and employ admission controllers to block images containing untrusted checkpoint state.
- Recreate Existing Containers: Terminate, remove, and recreate any running containers that were originally initialized from untrusted checkpoint archives.
Impact
An attacker who can schedule a container using an untrusted checkpoint image can achieve full host privilege escalation or container escape by executing processes as unconfined root with full Linux capabilities. Because CRI status reporting masks the true execution state, automated policy compliance tools reading the Kubernetes API fail to detect the elevated privileges.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
