Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Crane may allow attackers to run unauthorized code

published 18 days ago
Summary

The crane component used by Docker’s Moby container system contains a flaw that could let a remote user run their own programs on the affected machine. This could let an attacker take control, steal data, or disrupt services. Apply the latest update from the crane project or follow the vendor’s guidance to patch the issue.

What to do
  • Update cleanstart crane to version 0.19.2-r0.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart crane < 0.19.2-r0
Fix: upgrade to 0.19.2-r0
Original advisory text
Moby is an open-source project created by Docker for software containerization
Security vulnerability affects the crane package. Moby is an open-source project created by Docker for software containerization.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.9 Critical
Timeline
Published30 Sep 2026
Updated8 Oct 2026
First seen8 Oct 2026
Sources
CLEANSTART-2026-OZ76094 · OSV
Track software like this
Free during beta