Detections
Analytics

SCA: security update for github.com/containerd/containerd/v2 (GHSA-p7v4-vr35-mj6f)

high Tenable Self-Hosted Container Security Plugin ID 474713

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI
 CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from
 checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a
 container from a crafted checkpoint can supply restored credentials, capabilities, no_new_privs, and
 seccomp state. The restored process can run as root with full capabilities and no enforced seccomp filters
 while CRI status reports the requested configuration. Systems that do not use CRI checkpoint restore are
 not affected. This issue is fixed in versions 2.2.7 and 2.3.4. (CVE-2026-95837)

Solution

Update the github.com/containerd/containerd/v2 library and its related packages to version 2.2.7 or later.

See Also

https://github.com/advisories/GHSA-p7v4-vr35-mj6f

Plugin Details

Severity: High

ID: 474713

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.47

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-95837

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/15/2026

Vulnerability Publication Date: 10/12/2026

Reference Information

CVE: CVE-2026-95837

cwe: CWE-269