Is CVE-2026-34040 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34040 being exploited in the wild.

How severe is CVE-2026-34040?

High severity, with a CVSS score of 8.8, published 31 March 2026.

Which products and versions are affected?

Docker < 29.3.1; Docker Engine < 29.3.1; github.com/docker/docker (Go) < 29.3.1, SEMVER:introduced=0; github.com/moby/moby (Go) < 29.3.1, SEMVER:introduced=0, SEMVER:introduced=0,fixed=29.3.1; and 3 more.

Is there a fix for CVE-2026-34040?

Yes. github.com/moby/moby (Go): upgrade to 29.3.1 or later; github.com/moby/moby/v2 (Go): upgrade to 2.0.0-beta.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34040 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-34040?

Check whether you run Docker, Docker Engine, Docker Engine or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34040: Moby AuthZ plugin authorization bypass via oversized request body

Q: Which products and versions are affected?

Docker < 29.3.1; Docker Engine < 29.3.1; github.com/docker/docker (Go) < 29.3.1, SEMVER:introduced=0; github.com/moby/moby (Go) < 29.3.1, SEMVER:introduced=0, SEMVER:introduced=0,fixed=29.3.1; and 3 more.

Q: Is there a fix for CVE-2026-34040?

Yes. github.com/moby/moby (Go): upgrade to 29.3.1 or later; github.com/moby/moby/v2 (Go): upgrade to 2.0.0-beta.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-34040 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-34040?

Check whether you run Docker, Docker Engine, Docker Engine or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34040 · Severity: high · CVSS 8.8 · Published 2026-03-31

Moby is an open-source framework used to build and run software containers, most notably serving as the foundation for Docker. A security flaw in its authorization system allows an attacker to bypass security plugins that control access to the Docker API. If exploited, an attacker could perform unauthorized actions or gain elevated privileges on the host system, potentially leading to a full compromise of the container environment.

Technologies: Docker, Docker Engine, github.com/docker/docker (Go), github.com/moby/moby (Go), github.com/moby/moby/v2 (Go). Vendors: Docker, Go, Moby Project.

Quick answers

Is CVE-2026-34040 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34040 being exploited in the wild.
How severe is CVE-2026-34040?: High severity, with a CVSS score of 8.8, published 31 March 2026.
Which products and versions are affected?: Docker < 29.3.1; Docker Engine < 29.3.1; github.com/docker/docker (Go) < 29.3.1, SEMVER:introduced=0; github.com/moby/moby (Go) < 29.3.1, SEMVER:introduced=0, SEMVER:introduced=0,fixed=29.3.1; and 3 more.
Is there a fix for CVE-2026-34040?: Yes. github.com/moby/moby (Go): upgrade to 29.3.1 or later; github.com/moby/moby/v2 (Go): upgrade to 2.0.0-beta.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34040 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-34040?: Check whether you run Docker, Docker Engine, Docker Engine or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/moby/moby (Go): upgrade to 29.3.1 or later
```
go get github.com/moby/moby@v29.3.1
```
github.com/moby/moby/v2 (Go): upgrade to 2.0.0-beta.8 or later
```
go get github.com/moby/moby/v2@v2.0.0-beta.8
```

Technical details

A vulnerability in Moby (Docker Engine) allows an attacker to bypass Authorization (AuthZ) plugins. The issue stems from an incomplete fix for a previous vulnerability (CVE-2024-41110) regarding how the Docker daemon handles oversized request bodies. By sending a specially crafted API request, an attacker can cause the daemon to forward the request to an AuthZ plugin without its body. If the plugin relies on inspecting the request body to make access control decisions, it may incorrectly allow a request that should have been denied. This requires local access to the Docker API and affects configurations utilizing AuthZ plugins for security enforcement. The issue is resolved in version 29.3.1.

Affected products

Moby Project Moby < 29.3.1
Docker Docker Engine < 29.3.1

Identifiers

CVE-2026-34040
GHSA-x744-4wpc-v9h2
GO-2026-4887

Timeline

2026-03-25: patched: Fixed in version 29.3.1
2026-03-31: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.