# CVE-2026-115539: SwarmKit Cluster-API proxy TLS identity overwrite

Source: https://junglewise.ai/threats/cve-2026-115539-swarmkit-s-cluster-api-proxy-can-overwrite-a-forwarded-client-s  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-115539 · Severity: info · Published 2026-11-10

SwarmKit, a distributed clustering system used by Docker and container orchestration platforms, has a vulnerability in its proxy that can replace a worker node's TLS identity with a manager's identity. An attacker with a valid worker node certificate can exploit this during leader changes to obtain a manager node certificate, gaining escalated privileges. This affects deployments using SwarmKit with certain versions of the underlying gRPC library.

Technologies: [Docker](https://junglewise.ai/threats/technologies/docker). Vendors: [Docker](https://junglewise.ai/threats/vendors/docker), [Moby](https://junglewise.ai/threats/vendors/moby).

## Quick answers

**Is CVE-2026-115539 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115539 being exploited in the wild.

**How severe is CVE-2026-115539?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** Docker >= 23.0.0; Moby SwarmKit >= v1.12.1-0.20220307221335-616e8db4c3b0; Moby SwarmKit/v2 < 2.1.3.

**Is there a fix for CVE-2026-115539?** Yes: fixed in SwarmKit/v2 2.1.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115539 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-115539?** Check whether you run Docker, Moby SwarmKit or Moby SwarmKit/v2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in SwarmKit/v2 2.1.3

## Technical details

WithMetadataForwardTLSInfo in SwarmKit's Cluster-API proxy inadvertently overwrites outgoing TLS metadata with incoming metadata, defeating the redirect guard's identity preservation. The vulnerability requires grpc-go 1.39 or later (which changed metadata handling to return copies) combined with a transient window of inconsistent leader views after leader election. An attacker with a valid worker node TLS certificate and private key can perform privilege escalation to manager level.

## Affected products

- Moby SwarmKit >= v1.12.1-0.20220307221335-616e8db4c3b0
- Moby SwarmKit/v2 < 2.1.3
- Docker Docker >= 23.0.0

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/moby/swarmkit/security/advisories/GHSA-628g-hv7f-pgjc](https://github.com/moby/swarmkit/security/advisories/GHSA-628g-hv7f-pgjc)

## Related threats

- [Moby Docker Engine race condition in docker cp mount setup](https://junglewise.ai/threats/cve-2026-42306-moby-docker-engine-race-condition-in-docker-cp-mount-setup)
- [Moby AuthZ plugin authorization bypass via oversized request body](https://junglewise.ai/threats/cve-2026-34040-moby-authz-plugin-authorization-bypass-via-oversized-request-body)