PT-2026-28593 · Docker · Docker

Manizada · Published 2026-03-25 · Updated 2026-04-08 · CVE-2026-34040

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

High

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moby versions prior to 29.3.1

Description A security issue exists in Moby that allows attackers to bypass authorization plugins (AuthZ) by providing oversized request bodies. This bypass can lead to unauthorized privileged container creation, potentially resulting in host escape and lateral movement within container environments. The issue is an incomplete fix for CVE-2024-41110. If you depend on AuthZ plugins that introspect the request body to make access control decisions, you are potentially impacted.

Recommendations Update to version 29.3.1 or later to address this issue. If an immediate update is not possible, avoid using AuthZ plugins that rely on request body inspection for security decisions. Restrict access to the Docker API to trusted parties, following the principle of least privilege.

Exploit

Fix

Authentication Bypass Using an Alternate Path or Channel

Incorrect Authorization

Weakness Enumeration

CWE-288

CWE-863

Related Identifiers

CVE-2026-34040

GHSA-X744-4WPC-V9H2

GO-2026-4887

Affected Products

Docker

References · 40

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34040.json · Exploit
• https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34040 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34040 · Security Note
• https://osv.dev/vulnerability/GO-2026-4887 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x744-4wpc-v9h2 · Vendor Advisory
• https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq · Note
• https://github.com/moby/moby/releases/tag/docker-v29.3.1 · Note
• https://github.com/moby/moby · Note
• https://github.com/moby/moby/commit/e89edb19ad7de0407a5d31e3111cb01aa10b5a38 · Note
• https://twitter.com/byte_brief/status/2041689948936679534 · Twitter Post
• https://twitter.com/TechNowPulse/status/2041607116109074540 · Twitter Post
• https://twitter.com/grono_dev/status/2037267453281996902 · Twitter Post
• https://twitter.com/omvapt/status/2041737807836656061 · Twitter Post
• https://twitter.com/tatha_gautama/status/2041749905090433276 · Twitter Post