Name of the Vulnerable Software and Affected Versions:

Moby versions 28.2.0 through 28.3.2

Description:

Moby is an open source container framework developed by Docker Inc. When the firewalld service is reloaded, it removes all iptables rules, including those created by Docker. In affected versions, Docker fails to recreate the specific rules that block external access to containers. This allows remote machines with network routing to the Docker bridge to access containers with ports published to localhost, even though they should only be accessible from the host. The vulnerability only affects explicitly published ports; unpublished ports remain protected.

Recommendations:

Moby versions 28.2.0 through 28.3.2: Upgrade to version 28.3.3 or later.

As a workaround, restart the docker daemon after reloading firewalld.

As a workaround, re-create bridge networks after reloading firewalld.

As a workaround, use rootless mode.