Is CVE-2026-115538 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115538 being exploited in the wild.

How severe is CVE-2026-115538?

Informational severity, published 10 November 2026.

Which products and versions are affected?

Docker Engine < 29.9.3; also in Moby v2.0.0-beta.28 and earlier.

How is CVE-2026-115538 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-115538?

Check whether you run Docker Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115538: Moby overlay network encryption iptables rules bypass after firewalld reload

Q: Which products and versions are affected?

Docker Engine < 29.9.3; also in Moby v2.0.0-beta.28 and earlier.

Q: Is there a fix for CVE-2026-115538?

Yes: fixed in Docker Engine 29.9.3; Moby v2.0.0-beta.29. Until then: Configure firewalld to use FirewallBackend=nftables with a build that includes upstream commit b7faa74 (firewalld 2.0.0 or later, or backported RHEL packages firewalld-1.2.5-1.el9 and firewalld-0.9.11-9.el8), or remove direct firewalld rules and passthrough configuration to prevent iptables rule deletion. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-115538 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-115538?

Check whether you run Docker Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115538 · Severity: info · Published 2026-11-10

Moby's Docker Engine overlay network driver fails to restore critical encryption rules after firewalld reloads its firewall configuration on Swarm cluster nodes. When these rules are lost, encrypted container traffic between nodes is sent in cleartext and the network accepts spoofed unencrypted packets, exposing multi-node container network traffic to eavesdropping and injection attacks until dockerd is restarted.

Technologies: Docker Engine. Vendors: Docker.

Quick answers

Is CVE-2026-115538 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115538 being exploited in the wild.
How severe is CVE-2026-115538?: Informational severity, published 10 November 2026.
Which products and versions are affected?: Docker Engine < 29.9.3; also in Moby v2.0.0-beta.28 and earlier.
Is there a fix for CVE-2026-115538?: Yes: fixed in Docker Engine 29.9.3; Moby v2.0.0-beta.29. Until then: Configure firewalld to use FirewallBackend=nftables with a build that includes upstream commit b7faa74 (firewalld 2.0.0 or later, or backported RHEL packages firewalld-1.2.5-1.el9 and firewalld-0.9.11-9.el8), or remove direct firewalld rules and passthrough configuration to prevent iptables rule deletion. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115538 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-115538?: Check whether you run Docker Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Docker Engine 29.9.3; Moby v2.0.0-beta.29

Configure firewalld to use FirewallBackend=nftables with a build that includes upstream commit b7faa74 (firewalld 2.0.0 or later, or backported RHEL packages firewalld-1.2.5-1.el9 and firewalld-0.9.11-9.el8), or remove direct firewalld rules and passthrough configuration to prevent iptables rule deletion.

Technical details

The overlay network driver does not listen for firewalld reload or start signals over D-Bus, unlike other Docker networking components. When firewalld reloads, it flushes iptables rules including the mangle and filter table rules that Moby installs to enforce IPsec encryption of VXLAN datagrams and filter cleartext traffic. The condition persists and repeats with each firewalld event until a lifecycle event on the network or dockerd restart restores the rules.

Affected products

Docker Docker Engine < 29.9.3; also in Moby v2.0.0-beta.28 and earlier

Timeline

2026-11-10: disclosed

References

https://github.com/moby/moby/security/advisories/GHSA-6jhp-7446-hf7f

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.