Executive brief
Moby is an open-source framework used to build and run software containers, most notably as the foundation for Docker. A security flaw allows a malicious container to trick the system into mounting storage volumes onto the host computer's files instead of inside the container. This could allow an attacker to overwrite critical system files or disrupt services, potentially leading to a full system compromise or a denial-of-service state.
Technical details
A Time-of-Check Time-of-Use (TOCTOU) race condition exists in the Docker/Moby daemon during the setup of temporary mount namespaces for the 'docker cp' operation. When copying files, the daemon creates a mount destination within the container root and then executes a bind mount. A malicious process inside the container can exploit the window between mountpoint creation and the mount() syscall by replacing the destination path with a symbolic link. Because the mount() syscall follows symlinks, the volume is attached to an arbitrary host path. This allows an attacker to overwrite host files (if the volume is writable) or mask host paths (if read-only), causing a denial of service. Exploitation requires the container to have at least one volume mount and an operator to initiate a 'docker cp' or archive API call.
Affected products
- Docker Docker Engine < 29.5.1
- Docker Docker Daemon <= 28.5.2
- Moby Moby Daemon < 2.0.0-beta.14
Timeline
- 2026-05-18: advisory: Initial GitHub advisory published
- 2026-06-12: disclosed: CVE published to NVD