Executive brief
Moby is an open-source framework used to build and run software containers, most notably serving as the foundation for Docker. A security flaw in its authorization system allows an attacker to bypass security plugins that control access to the Docker API. If exploited, an attacker could perform unauthorized actions or gain elevated privileges on the host system, potentially leading to a full compromise of the container environment.
Technical details
A vulnerability in Moby (Docker Engine) allows an attacker to bypass Authorization (AuthZ) plugins. The issue stems from an incomplete fix for a previous vulnerability (CVE-2024-41110) regarding how the Docker daemon handles oversized request bodies. By sending a specially crafted API request, an attacker can cause the daemon to forward the request to an AuthZ plugin without its body. If the plugin relies on inspecting the request body to make access control decisions, it may incorrectly allow a request that should have been denied. This requires local access to the Docker API and affects configurations utilizing AuthZ plugins for security enforcement. The issue is resolved in version 29.3.1.
Affected products
- Moby Project Moby < 29.3.1
- Docker Docker Engine < 29.3.1
Timeline
- 2026-03-25: patched: Fixed in version 29.3.1
- 2026-03-31: disclosed: NVD publication date