ALT-PU-2026-17669-4 — docker-engine

BDU:2026-07864

HIGH8.1

Уязвимость системы плагинов Docker программного средства для создания систем контейнерной изоляции Moby (Docker Engine), позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации

Published: 2026-06-07Modified: 2026-09-16

CVSS 3.xHIGH 8.1

CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CVSS 2.0CRITICAL 9.4

CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:N

References

BDU:2026-07865

HIGH8.8

Уязвимость плагина AuthZ программного средства для создания систем контейнерной изоляции Moby, позволяющая нарушителю повысить свои привилегии

Published: 2026-06-07Modified: 2026-09-16

CVSS 3.xHIGH 8.8

CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS 2.0MEDIUM 6.8

CVSS:2.0/AV:L/AC:L/Au:S/C:C/I:C/A:C

References

BDU:2026-09697

MEDIUM6.1

Уязвимость программного средства для создания систем контейнерной изоляции Moby, связанная с ошибками синхронизации при использовании общего ресурса, позволяющая нарушителю читать и записывать произвольные файлы

Published: 2026-07-13Modified: 2026-09-16

CVSS 3.xMEDIUM 6.1

CVSS:3.x/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:H

CVSS 2.0MEDIUM 4.5

CVSS:2.0/AV:L/AC:H/Au:S/C:N/I:P/A:C

References

BDU:2026-09736

HIGH7.2

Уязвимость программного средства для создания систем контейнерной изоляции Moby, связанная с ошибками синхронизации при использовании общего ресурса, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-07-14Modified: 2026-09-16

CVSS 3.xHIGH 7.2

CVSS:3.x/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H

CVSS 2.0MEDIUM 5.5

CVSS:2.0/AV:L/AC:H/Au:S/C:N/I:C/A:C

References

BDU:2026-15265

HIGH7.1

Уязвимость программного средства сборки контейнеров BuildKit, связанная с неверным ограничением имени пути к каталогу с ограниченным доступом, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2026-09-24

CVSS 3.xHIGH 7.1

CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CVSS 2.0MEDIUM 6.2

CVSS:2.0/AV:L/AC:L/Au:S/C:N/I:C/A:C

References

BDU:2026-15266

MEDIUM4.4

Уязвимость программного средства сборки контейнеров BuildKit, связанная с неверным ограничением имени пути к каталогу с ограниченным доступом, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2026-09-24

CVSS 3.xMEDIUM 4.4

CVSS:3.x/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

CVSS 2.0LOW 3.6

CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:P/A:P

References

BDU:2026-15267

MEDIUM6.5

Уязвимость программного средства сборки контейнеров BuildKit, связанная с недостаточной проверкой вводимых данных, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-09-24

CVSS 3.xMEDIUM 6.5

CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS 2.0MEDIUM 6.8

CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:N/A:C

References

BDU:2026-15268

HIGH8.0

Уязвимость программного средства сборки контейнеров BuildKit, связанная с внедрением или модификацией аргументов, позволяющая нарушителю выполнить произвольные команды

Published: 2026-09-24

CVSS 3.xHIGH 8.0

CVSS:3.x/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CVSS 2.0HIGH 8.3

CVSS:2.0/AV:N/AC:L/Au:M/C:C/I:C/A:C

References

BDU:2026-16238

HIGH7.8

Уязвимость демона dockerd библиотеки go-archive интерфейса командной строки платформы для разработки и доставки контейнерных приложений Docker Desktop и инструмента для управления многоконтейнерными приложениями Docker Compose, позволяющая нарушителю получить доступ на создание и запись произвольных файлов

Published: 2026-10-12

CVSS 3.xHIGH 7.8

CVSS:3.x/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS 2.0HIGH 7.2

CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:C

References

CVE-2026-15788

MEDIUM5.6

BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon process.

Published: 2026-07-20Modified: 2026-08-05

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS 4.0MEDIUM 5.6

CVSS:4.0/CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

https://github.com/moby/buildkit/security/advisories/GHSA-388v-wmr2-g2v2

CVE-2026-15789

MEDIUM6.9

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc.

Published: 2026-07-21Modified: 2026-07-30

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS 4.0

CVSS:4.0/CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

https://github.com/moby/buildkit/security/advisories/GHSA-g2h8-426c-7976

CVE-2026-15791

LOW1.8

A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory.

Published: 2026-07-21Modified: 2026-07-30

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS 4.0LOW 1.8

CVSS:4.0/CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

https://github.com/moby/buildkit/security/advisories/GHSA-32pv-7hq5-qhwq

CVE-2026-15792

MEDIUM6.0

A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.

Published: 2026-07-21Modified: 2026-07-30

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS 4.0MEDIUM 6.0

CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

https://github.com/moby/buildkit/security/advisories/GHSA-qx3x-mv6r-52p6

CVE-2026-15793

HIGH7.3

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.

Published: 2026-07-21Modified: 2026-07-30

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS 4.0HIGH 7.3

CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

https://github.com/moby/buildkit/security/advisories/GHSA-hw3h-2gp9-cxpv

CVE-2026-17106

HIGH7.1

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

Published: 2026-08-18Modified: 2026-08-28

CVSS 4.0HIGH 7.1

CVSS:4.0/CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

CVE-2026-33997

HIGH8.1

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.

Published: 2026-03-31Modified: 2026-09-09

CVSS 3.xHIGH 8.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

CVE-2026-34040

HIGH7.8

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

Published: 2026-03-31Modified: 2026-06-17

CVSS 3.xHIGH 7.8

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

CVE-2026-41568

MEDIUM6.1

Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.

Published: 2026-06-12Modified: 2026-06-17

CVSS 3.xMEDIUM 6.1

CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:H

References

https://github.com/moby/moby/security/advisories/GHSA-vp62-88p7-qqf5

CVE-2026-42306

HIGH7.2

Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.

Published: 2026-06-12Modified: 2026-06-17

CVSS 3.xHIGH 7.2

CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H

References

https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh

GHSA-hfg8-hc9c-6c3h

HIGH7.1

moby/go-archive: Crafted tar archive can write outside the extraction directory

Published: 2026-08-18

CVSS 4.0HIGH 7.1

CVSS:4.0/CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

GHSA-pxq6-2prw-chj9

MEDIUM6.8

Moby has an Off-by-one error in its plugin privilege validation

Published: 2026-03-27Modified: 2026-03-31

CVSS 3.xMEDIUM 6.8

CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References

GHSA-rg2x-37c3-w2rh

HIGH7.2

Docker: Race condition in docker cp allows bind mount redirection to host path

Published: 2026-05-18Modified: 2026-06-12

CVSS 3.xHIGH 7.2

CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H

References

GHSA-vp62-88p7-qqf5

MEDIUM6.1

Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap

Published: 2026-05-18Modified: 2026-06-12

CVSS 3.xMEDIUM 6.1

CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:H

References

GHSA-x744-4wpc-v9h2

HIGH8.8

Moby has AuthZ plugin bypass when provided oversized request bodies

Published: 2026-03-27Modified: 2026-08-24

CVSS 3.xHIGH 8.8

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Package update docker-engine in branch c10f2

Closed issues (24)

Уязвимость плагина AuthZ программного средства для создания систем контейнерной изоляции Moby, позволяющая нарушителю повысить свои привилегии

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc.

A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory.

A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

moby/go-archive: Crafted tar archive can write outside the extraction directory

Moby has an Off-by-one error in its plugin privilege validation

Docker: Race condition in docker cp allows bind mount redirection to host path

Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap

Moby has AuthZ plugin bypass when provided oversized request bodies