Executive brief
Moby is an open-source framework used to build and run software containers, most notably powering Docker Engine. A flaw in how the system handles plugin installations allows a malicious plugin to gain more permissions than a user actually authorized. If an administrator installs a compromised plugin, the attacker could gain unauthorized access to sensitive system resources or data, though this requires the user to manually initiate the installation of a malicious plugin.
Technical details
An off-by-one error (CWE-193) exists in the Moby daemon's privilege comparison logic during the 'docker plugin install' process. When a user approves a set of privileges, the daemon fails to correctly validate the requested set against the approved set; specifically, if a plugin requests exactly one privilege, no comparison is performed at all. An attacker can exploit this by crafting a malicious plugin that requests sensitive permissions (such as broad device access) which differ from those displayed to and approved by the user. Exploitation requires network delivery of a malicious plugin and user interaction to trigger the installation. The issue is patched in version 29.3.1.
Affected products
- Moby Project Moby < 29.3.1
- Docker Docker Engine < 29.3.1
Timeline
- 2026-03-25: patched: Fixed in version 29.3.1
- 2026-03-25: advisory: GitHub Security Advisory GHSA-pxq6-2prw-chj9 published
- 2026-03-31: disclosed: CVE-2026-33997 published to NVD