CVE-2026-33997: Moby privilege validation bypass in docker plugin install

CVE-2026-33997 · Severity: medium · CVSS 6.8 · Published 2026-03-31

Moby is an open-source framework used to build and run software containers, most notably powering Docker Engine. A flaw in how the system handles plugin installations allows a malicious plugin to gain more permissions than a user actually authorized. If an administrator installs a compromised plugin, the attacker could gain unauthorized access to sensitive system resources or data, though this requires the user to manually initiate the installation of a malicious plugin.

Technologies: Docker Engine, github.com/docker/docker (Go), github.com/moby/moby (Go), github.com/moby/moby/v2 (Go). Vendors: Docker, Go.

Quick answers

Is CVE-2026-33997 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33997 being exploited in the wild.
How severe is CVE-2026-33997?
Medium severity, with a CVSS score of 6.8, published 31 March 2026.
Which products and versions are affected?
Docker Engine < 29.3.1; github.com/docker/docker (Go) SEMVER:introduced=0; github.com/moby/moby (Go) SEMVER:introduced=0; github.com/moby/moby/v2 (Go) SEMVER:introduced=0,fixed=2.0.0-beta.8.
Is there a fix for CVE-2026-33997?
Yes. github.com/moby/moby/v2 (Go): upgrade to 2.0.0-beta.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33997 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33997?
Check whether you run Docker Engine, Docker Engine, github.com/docker/docker (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/moby/moby/v2 (Go): upgrade to 2.0.0-beta.8 or later
    go get github.com/moby/moby/v2@v2.0.0-beta.8

Technical details

An off-by-one error (CWE-193) exists in the Moby daemon's privilege comparison logic during the 'docker plugin install' process. When a user approves a set of privileges, the daemon fails to correctly validate the requested set against the approved set; specifically, if a plugin requests exactly one privilege, no comparison is performed at all. An attacker can exploit this by crafting a malicious plugin that requests sensitive permissions (such as broad device access) which differ from those displayed to and approved by the user. Exploitation requires network delivery of a malicious plugin and user interaction to trigger the installation. The issue is patched in version 29.3.1.

Affected products

  • Moby Project Moby < 29.3.1
  • Docker Docker Engine < 29.3.1

Identifiers

  • CVE-2026-33997
  • GHSA-pxq6-2prw-chj9
  • GO-2026-4883

Timeline

  • 2026-03-25: patched: Fixed in version 29.3.1
  • 2026-03-25: advisory: GitHub Security Advisory GHSA-pxq6-2prw-chj9 published
  • 2026-03-31: disclosed: CVE-2026-33997 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.