Is CVE-2026-115539 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115539 being exploited in the wild.

How severe is CVE-2026-115539?

Informational severity, published 10 November 2026.

Which products and versions are affected?

Docker >= 23.0.0; Moby SwarmKit >= v1.12.1-0.20220307221335-616e8db4c3b0; Moby SwarmKit/v2 < 2.1.3.

Is there a fix for CVE-2026-115539?

Yes: fixed in SwarmKit/v2 2.1.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-115539 attacked?

It is attacked over the network.

Am I affected by CVE-2026-115539?

Check whether you run Docker, Moby SwarmKit or Moby SwarmKit/v2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115539: SwarmKit Cluster-API proxy TLS identity overwrite

Q: Is there a fix for CVE-2026-115539?

Yes: fixed in SwarmKit/v2 2.1.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-115539 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-115539?

Check whether you run Docker, Moby SwarmKit or Moby SwarmKit/v2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115539 · Severity: info · Published 2026-11-10

SwarmKit, a distributed clustering system used by Docker and container orchestration platforms, has a vulnerability in its proxy that can replace a worker node's TLS identity with a manager's identity. An attacker with a valid worker node certificate can exploit this during leader changes to obtain a manager node certificate, gaining escalated privileges. This affects deployments using SwarmKit with certain versions of the underlying gRPC library.

Technologies: Docker. Vendors: Docker, Moby.

Quick answers

Is CVE-2026-115539 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115539 being exploited in the wild.
How severe is CVE-2026-115539?: Informational severity, published 10 November 2026.
Which products and versions are affected?: Docker >= 23.0.0; Moby SwarmKit >= v1.12.1-0.20220307221335-616e8db4c3b0; Moby SwarmKit/v2 < 2.1.3.
Is there a fix for CVE-2026-115539?: Yes: fixed in SwarmKit/v2 2.1.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115539 attacked?: It is attacked over the network.
Am I affected by CVE-2026-115539?: Check whether you run Docker, Moby SwarmKit or Moby SwarmKit/v2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: SwarmKit/v2 2.1.3

Technical details

WithMetadataForwardTLSInfo in SwarmKit's Cluster-API proxy inadvertently overwrites outgoing TLS metadata with incoming metadata, defeating the redirect guard's identity preservation. The vulnerability requires grpc-go 1.39 or later (which changed metadata handling to return copies) combined with a transient window of inconsistent leader views after leader election. An attacker with a valid worker node TLS certificate and private key can perform privilege escalation to manager level.

Affected products

Moby SwarmKit >= v1.12.1-0.20220307221335-616e8db4c3b0
Moby SwarmKit/v2 < 2.1.3
Docker Docker >= 23.0.0

Timeline

2026-11-10: disclosed

References

https://github.com/moby/swarmkit/security/advisories/GHSA-628g-hv7f-pgjc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.