StackRadar

CVE-2026-95837

High

Advisory

Published 12 Oct 2026In the index since 14 Oct 2026
Severity
High
worst across findings
CVSS
7.8
base score, highest
EPSS
0.001
1st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
42
of 18,137 indexed, latest versions
Container images
41
deployed by those charts
Fix available
1 of 2
affected packages

containerd CRI plugin: Checkpoint restore bypasses destination security context

Carried by container images the latest versions of 42 of 18,137 indexed charts deploy, on 41 images.

Affected packageAffected versionsFixed inImages
github.com/containerd/containerd/v2golangv2.1.1, v2.1.3, v2.1.4, v2.2.0+10 more2.2.7, 2.3.440
containerddeb1.6.20~ds1-1+deb12u3no fix listed1
OSV records
DEBIAN-CVE-2026-95837GHSA-p7v4-vr35-mj6f

Charts affected

42 by stars
ChartLatestAffected imagesRadar Score
harborharborOfficialVerified publisher1.19.21 of 8See more

harbor harbor 1.19.2

1 of the 8 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
github.com/containerd/containerd/v2@v2.3.2
2.3.4

Open the chart page →

3,440
rancherrancher-stable2.15.22 of 2See more

rancher rancher-stable 2.15.2

2 of the 2 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
rancher/rancher:v2.15.20c3d8e570255
github.com/containerd/containerd/v2@v2.3.2-k3s2
2.3.4
rancher/shell:v0.8.21eeed72d4eda
github.com/containerd/containerd/v2@v2.2.4
2.2.7

Open the chart page →

2,662
artifact-hubartifact-hubVerified publisher1.23.02 of 7See more

artifact-hub artifact-hub 1.23.0

2 of the 7 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
aquasec/trivy:0.69.3bcc376de8d77
github.com/containerd/containerd/v2@v2.2.0
2.2.7
artifacthub/scanner:v1.23.02d8365601f0e
github.com/containerd/containerd/v2@v2.2.0
2.2.7

Open the chart page →

15,103
portainerportainer245.2.01 of 1See more

portainer portainer 245.2.0

1 of the 1 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
portainer/portainer-ce:2.45.203f94a406496
github.com/containerd/containerd/v2@v2.2.5
2.2.7

Open the chart page →

585
rancherrancher-latest2.15.22 of 2See more

rancher rancher-latest 2.15.2

2 of the 2 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
rancher/rancher:v2.15.20c3d8e570255
github.com/containerd/containerd/v2@v2.3.2-k3s2
2.3.4
rancher/shell:v0.8.21eeed72d4eda
github.com/containerd/containerd/v2@v2.2.4
2.2.7

Open the chart page →

2,662
oktetooktetoOfficialVerified publisher0.0.0-2026-08-312 of 10See more

okteto okteto 0.0.0-2026-08-31

2 of the 10 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
ghcr.io/okteto/buildkit:0.0.0-2026-08-3114527ca5d2a9
github.com/containerd/containerd/v2@v2.2.4
2.2.7
ghcr.io/okteto/okteto:3.23.0-beta.1a0483d47ba04
github.com/containerd/containerd/v2@v2.2.5
2.2.7

Open the chart page →

8,657
kubescape-operatorkubescape1.40.52 of 6See more

kubescape-operator kubescape 1.40.5

2 of the 6 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
quay.io/kubescape/kubescape:v4.0.14418fa941ecc0
github.com/containerd/containerd/v2@v2.2.5
2.2.7
quay.io/kubescape/kubevuln:v0.3.4309bed2f723ea0
github.com/containerd/containerd/v2@v2.2.5
2.2.7

Open the chart page →

2,530
codefreshcodefresh-onpremOfficialVerified publisher2.12.221 of 42See more

codefresh codefresh-onprem 2.12.22

1 of the 42 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
quay.io/codefresh/dind:3.0.250885ab519dac
github.com/containerd/containerd/v2@v2.3.3
2.3.4

Open the chart page →

20,035
spegelspegelVerified publisher0.7.41 of 1See more

spegel spegel 0.7.4

1 of the 1 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
ghcr.io/spegel-org/spegeldigest-pinned26c60b05e08a
github.com/containerd/containerd/v2@v2.2.6
2.2.7

Open the chart page →

520
dependabot-gitlabdependabot-gitlabVerified publisher6.3.01 of 3See more

dependabot-gitlab dependabot-gitlab 6.3.0

1 of the 3 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
andrcuns/dependabot-gitlab:7.7.0-alpha.143060f159f4c
github.com/containerd/containerd/v2@v2.3.3
2.3.4

Open the chart page →

43,071
nuclionuclio0.23.101 of 2See more

nuclio nuclio 0.23.10

1 of the 2 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
quay.io/nuclio/dashboard:1.17.10-amd64539b498e7ca1
github.com/containerd/containerd/v2@v2.2.3
2.2.7

Open the chart page →

1,512
kubearmorkubearmor1.7.61 of 4See more

kubearmor kubearmor 1.7.6

1 of the 4 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
kubearmor/kubearmor:stablea08141311045
github.com/containerd/containerd/v2@v2.3.2
2.3.4

Open the chart page →

2,108
olivetinolivetinOfficialVerified publisher4.0.01 of 1See more

olivetin olivetin 4.0.0

1 of the 1 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
jamesread/olivetin:3000.19.0af9d7c4db6dc
github.com/containerd/containerd/v2@v2.3.3
2.3.4

Open the chart page →

776
oesopsmxVerified publisher4.0.321 of 25See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/opa:1.12.084fb1af7401c
github.com/containerd/containerd/v2@v2.2.0
2.2.7

Open the chart page →

112,529
buildkitdwiremindVerified publisher0.33.11 of 1See more

buildkitd wiremind 0.33.1

1 of the 1 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
moby/buildkit:v0.32.2-rootless504731e577c2
github.com/containerd/containerd/v2@v2.3.3
2.3.4

Open the chart page →

1,683
hiverhiverVerified publisher0.1.451 of 10See more

hiver hiver 0.1.45

1 of the 10 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
hiversh/controller:0.1.45b0b85f8942c7
containerd@1.6.20~ds1-1+deb12u3
no fix listed

Open the chart page →

31,162
lagoon-remotelagoon-chartsVerified publisher0.107.01 of 1See more

lagoon-remote lagoon-charts 0.107.0

1 of the 1 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
uselagoon/docker-host:v3.6.12c89ed939b8b
github.com/containerd/containerd/v2@v2.1.1
2.2.7

Open the chart page →

3,107
orbitalregorbitalregVerified publisher0.4.21 of 5See more

orbitalreg orbitalreg 0.4.2

1 of the 5 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
orbitalreg/orbitalreg-scanner:0.4.27497639e8edd
github.com/containerd/containerd/v2@v2.3.2
2.3.4

Open the chart page →

5,539
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
github.com/containerd/containerd/v2@v2.3.1
2.3.4

Open the chart page →

10,496
stackradar-scannerstackradarVerified publisher0.6.01 of 1See more

stackradar-scanner stackradar 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
ghcr.io/lockdep/stackradar-scanner:0.6.0a90480c17377
github.com/containerd/containerd/v2@v2.2.1
2.2.7

Open the chart page →

1,893
harborwener1.19.21 of 8See more

harbor wener 1.19.2

1 of the 8 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
github.com/containerd/containerd/v2@v2.3.2
2.3.4

Open the chart page →

3,440
buildkit-serviceandrcunsVerified publisher1.8.01 of 1See more

buildkit-service andrcuns 1.8.0

1 of the 1 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
moby/buildkit:v0.31.0a095b3d11ce1
github.com/containerd/containerd/v2@v2.2.4
2.2.7

Open the chart page →

1,881
appwriteappwrite-helmVerified publisher1.3.21 of 8See more

appwrite appwrite-helm 1.3.2

1 of the 8 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
appwrite/appwrite:1.9.01aaa70127114
github.com/containerd/containerd/v2@v2.1.4
2.2.7

Open the chart page →

13,374
attestkeepattestkeepVerified publisher1.3.71 of 2See more

attestkeep attestkeep 1.3.7

1 of the 2 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
ghcr.io/attestkeep/attestkeep-k8s:1.3.71fbf69c89003
github.com/containerd/containerd/v2@v2.3.3
2.3.4

Open the chart page →

1,311
ranchercarbide-charts2.15.22 of 2See more

rancher carbide-charts 2.15.2

2 of the 2 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
rancher/rancher:v2.15.20c3d8e570255
github.com/containerd/containerd/v2@v2.3.2-k3s2
2.3.4
rancher/shell:v0.8.21eeed72d4eda
github.com/containerd/containerd/v2@v2.2.4
2.2.7

Open the chart page →

2,662
syncoor-serverethereum-helm-chartsVerified publisher0.0.11 of 1See more

syncoor-server ethereum-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
ghcr.io/ethpandaops/syncoor:master233aa9808fc7
github.com/containerd/containerd/v2@v2.2.4
2.2.7

Open the chart page →

1,472
harborgpg-dev1.18.31 of 8See more

harbor gpg-dev 1.18.3

1 of the 8 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.14.35c6f7162804c
github.com/containerd/containerd/v2@v2.2.0
2.2.7

Open the chart page →

5,531
appwritehelmforgeVerified publisher2.0.41 of 5See more

appwrite helmforge 2.0.4

1 of the 5 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
appwrite/appwrite:2.3.034ef77fb6e87
github.com/containerd/containerd/v2@v2.2.3
2.2.7

Open the chart page →

5,498
k8s-ai-srek8s-ai-sreVerified publisher3.1.21 of 1See more

k8s-ai-sre k8s-ai-sre 3.1.2

1 of the 1 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
mohankrishna999/k8s-ai-agent:3.1.27f980f8c650c
github.com/containerd/containerd/v2@v2.3.3
2.3.4

Open the chart page →

1,030
dockerdkarljorgensen0.1.01 of 1See more

dockerd karljorgensen 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
library/docker:28.5.2-dind2a232a42256f
github.com/containerd/containerd/v2@v2.1.4
2.2.7

Open the chart page →

2,717
kube-ovnkube-ovn-test1.14.01 of 1See more

kube-ovn kube-ovn-test 1.14.0

1 of the 1 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
kubeovn/kube-ovn:v1.14.06722b54eb5c0
github.com/containerd/containerd/v2@v2.1.3
2.2.7

Open the chart page →

6,159
lagoon-docker-hostlagoon-chartsVerified publisher0.7.01 of 1See more

lagoon-docker-host lagoon-charts 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
uselagoon/docker-host:v3.6.12c89ed939b8b
github.com/containerd/containerd/v2@v2.1.1
2.2.7

Open the chart page →

3,107
litefunctionslitefunctions0.1.12 of 19See more

litefunctions litefunctions 0.1.1

2 of the 19 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
library/docker:28.3.3-dinda56b3bdde893
github.com/containerd/containerd/v2@v2.1.4
2.2.7
ghcr.io/project-zot/zot:v2.1.144183bd731bcc
github.com/containerd/containerd/v2@v2.2.0
2.2.7

Open the chart page →

20,038
gitea-runnerm0sh1-helm-charts0.2.31 of 2See more

gitea-runner m0sh1-helm-charts 0.2.3

1 of the 2 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
library/docker:29.3.0-dind-alpine3.231ba18449911d
github.com/containerd/containerd/v2@v2.2.1
2.2.7

Open the chart page →

5,327
pro-builderopenfaas0.6.132 of 2See more

pro-builder openfaas 0.6.13

2 of the 2 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
moby/buildkit:v0.32.2-rootless504731e577c2
github.com/containerd/containerd/v2@v2.3.3
2.3.4
ghcr.io/openfaasltd/pro-builder:0.6.06c17297f9098
github.com/containerd/containerd/v2@v2.2.3
2.2.7

Open the chart page →

3,826
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.02 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

2 of the 40 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
gcr.io/kaniko-project/executor:latest4e7a52dd1f14
github.com/containerd/containerd/v2@v2.1.1
2.2.7
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
github.com/containerd/containerd/v2@v2.2.5
2.2.7

Open the chart page →

242,362
prowlerprowler0.1.11 of 1See more

prowler prowler 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
toniblyx/prowler:stable9dbcc3c9abd7
github.com/containerd/containerd/v2@v2.3.3
2.3.4

Open the chart page →

2,259
trivysecurecodebox-trivy5.9.01 of 1See more

trivy securecodebox-trivy 5.9.0

1 of the 1 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
aquasec/trivy:0.74.062b1e65e8869
github.com/containerd/containerd/v2@v2.3.3
2.3.4

Open the chart page →

852
terminusterminusVerified publisher1.1.01 of 1See more

terminus terminus 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
ghcr.io/terminus-io/enforcer:v1.1.0f21b905610d6
github.com/containerd/containerd/v2@v2.2.2
2.2.7

Open the chart page →

1,152
rancherwener2.15.22 of 2See more

rancher wener 2.15.2

2 of the 2 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
rancher/rancher:v2.15.20c3d8e570255
github.com/containerd/containerd/v2@v2.3.2-k3s2
2.3.4
rancher/shell:v0.8.21eeed72d4eda
github.com/containerd/containerd/v2@v2.2.4
2.2.7

Open the chart page →

2,662
harborwenerme1.19.21 of 8See more

harbor wenerme 1.19.2

1 of the 8 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
github.com/containerd/containerd/v2@v2.3.2
2.3.4

Open the chart page →

3,440
rancherwenerme2.15.22 of 2See more

rancher wenerme 2.15.2

2 of the 2 container images this version deploys carry CVE-2026-95837.

Container imageDigestPackageFixed in
rancher/rancher:v2.15.20c3d8e570255
github.com/containerd/containerd/v2@v2.3.2-k3s2
2.3.4
rancher/shell:v0.8.21eeed72d4eda
github.com/containerd/containerd/v2@v2.2.4
2.2.7

Open the chart page →

2,662

Container images carrying it

41 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
rancher/rancher:v2.15.20c3d8e570255
github.com/containerd/containerd/v2@v2.3.2-k3s2
2.3.4
5
rancher/shell:v0.8.21eeed72d4eda
github.com/containerd/containerd/v2@v2.2.4
2.2.7
5
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
github.com/containerd/containerd/v2@v2.3.2
2.3.4
3
moby/buildkit:v0.32.2-rootless504731e577c2
github.com/containerd/containerd/v2@v2.3.3
2.3.4
2
uselagoon/docker-host:v3.6.12c89ed939b8b
github.com/containerd/containerd/v2@v2.1.1
2.2.7
2
andrcuns/dependabot-gitlab:7.7.0-alpha.143060f159f4c
github.com/containerd/containerd/v2@v2.3.3
2.3.4
1
appwrite/appwrite:1.9.01aaa70127114
github.com/containerd/containerd/v2@v2.1.4
2.2.7
1
appwrite/appwrite:2.3.034ef77fb6e87
github.com/containerd/containerd/v2@v2.2.3
2.2.7
1
aquasec/trivy:0.74.062b1e65e8869
github.com/containerd/containerd/v2@v2.3.3
2.3.4
1
aquasec/trivy:0.69.3bcc376de8d77
github.com/containerd/containerd/v2@v2.2.0
2.2.7
1
artifacthub/scanner:v1.23.02d8365601f0e
github.com/containerd/containerd/v2@v2.2.0
2.2.7
1
goharbor/trivy-adapter-photon:v2.14.35c6f7162804c
github.com/containerd/containerd/v2@v2.2.0
2.2.7
1
hiversh/controller:0.1.45b0b85f8942c7
containerd@1.6.20~ds1-1+deb12u3
no fix listed
1
jamesread/olivetin:3000.19.0af9d7c4db6dc
github.com/containerd/containerd/v2@v2.3.3
2.3.4
1
kubearmor/kubearmor:stablea08141311045
github.com/containerd/containerd/v2@v2.3.2
2.3.4
1
kubeovn/kube-ovn:v1.14.06722b54eb5c0
github.com/containerd/containerd/v2@v2.1.3
2.2.7
1
library/docker:29.3.0-dind-alpine3.231ba18449911d
github.com/containerd/containerd/v2@v2.2.1
2.2.7
1
library/docker:28.5.2-dind2a232a42256f
github.com/containerd/containerd/v2@v2.1.4
2.2.7
1
library/docker:28.3.3-dinda56b3bdde893
github.com/containerd/containerd/v2@v2.1.4
2.2.7
1
moby/buildkit:v0.31.0a095b3d11ce1
github.com/containerd/containerd/v2@v2.2.4
2.2.7
1
mohankrishna999/k8s-ai-agent:3.1.27f980f8c650c
github.com/containerd/containerd/v2@v2.3.3
2.3.4
1
orbitalreg/orbitalreg-scanner:0.4.27497639e8edd
github.com/containerd/containerd/v2@v2.3.2
2.3.4
1
portainer/portainer-ce:2.45.203f94a406496
github.com/containerd/containerd/v2@v2.2.5
2.2.7
1
prowlercloud/prowler-api:5.31.14f252d579be2
github.com/containerd/containerd/v2@v2.3.1
2.3.4
1
toniblyx/prowler:stable9dbcc3c9abd7
github.com/containerd/containerd/v2@v2.3.3
2.3.4
1
gcr.io/kaniko-project/executor:latest4e7a52dd1f14
github.com/containerd/containerd/v2@v2.1.1
2.2.7
1
ghcr.io/attestkeep/attestkeep-k8s:1.3.71fbf69c89003
github.com/containerd/containerd/v2@v2.3.3
2.3.4
1
ghcr.io/ethpandaops/syncoor:master233aa9808fc7
github.com/containerd/containerd/v2@v2.2.4
2.2.7
1
ghcr.io/lockdep/stackradar-scanner:0.6.0a90480c17377
github.com/containerd/containerd/v2@v2.2.1
2.2.7
1
ghcr.io/okteto/buildkit:0.0.0-2026-08-03:0.0.0-2026-08-17:0.0.0-2026-08-24:0.0.0-2026-08-3114527ca5d2a9
github.com/containerd/containerd/v2@v2.2.4
2.2.7
1
ghcr.io/okteto/okteto:3.23.0-beta.1a0483d47ba04
github.com/containerd/containerd/v2@v2.2.5
2.2.7
1
ghcr.io/openfaasltd/pro-builder:0.6.06c17297f9098
github.com/containerd/containerd/v2@v2.2.3
2.2.7
1
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
github.com/containerd/containerd/v2@v2.2.5
2.2.7
1
ghcr.io/project-zot/zot:v2.1.144183bd731bcc
github.com/containerd/containerd/v2@v2.2.0
2.2.7
1
ghcr.io/spegel-org/spegel26c60b05e08a
github.com/containerd/containerd/v2@v2.2.6
2.2.7
1
ghcr.io/terminus-io/enforcer:v1.1.0f21b905610d6
github.com/containerd/containerd/v2@v2.2.2
2.2.7
1
quay.io/codefresh/dind:3.0.250885ab519dac
github.com/containerd/containerd/v2@v2.3.3
2.3.4
1
quay.io/kubescape/kubescape:v4.0.14418fa941ecc0
github.com/containerd/containerd/v2@v2.2.5
2.2.7
1
quay.io/kubescape/kubevuln:v0.3.4309bed2f723ea0
github.com/containerd/containerd/v2@v2.2.5
2.2.7
1
quay.io/nuclio/dashboard:1.17.10-amd64539b498e7ca1
github.com/containerd/containerd/v2@v2.2.3
2.2.7
1
quay.io/opsmxpublic/opa:1.12.084fb1af7401c
github.com/containerd/containerd/v2@v2.2.0
2.2.7
1

syft 1.42.1 · advisories as of 16 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.