Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-34040: Docker Engine before 29.3.1 lets attackers skip access checks
CVE-2026-34040 · published 7 months ago
Summary
The Docker Engine container platform (versions prior to 29.3.1) contains a flaw that lets a malicious user avoid the normal permission checks performed by its authorization plugins. This could allow an attacker to perform actions they are not supposed to be able to do within your containers. Upgrade to version 29.3.1 or later to close the gap.
What to do
- Update github.com moby to version 2.0.0-beta.8.
- Update moby github.com/moby/moby/v2 to version 2.0.0-beta.8.
- Update docker github.com/docker/docker to version v28.5.2+incompatible-aikido.4.
- Update docker rootio-github.com/docker/docker to version v28.5.2-root.io.4+incompatible.
- Update docker rootio-github.com/docker/docker to version v28.5.2-root.io.5+incompatible.
- Update docker rootio-github.com/docker/docker to version v28.5.2+incompatible-root.io.4.
- Update docker github.com/docker/docker to version v28.5.2-aikido.7+incompatible.
- Update docker rootio-github.com/docker/docker to version v27.1.1-root.io.3+incompatible.
- Update docker github.com/docker/docker to version v28.5.2-aikido.8+incompatible.
- Update docker github.com/docker/docker to version v28.5.2-aikido.9+incompatible.
- Update docker rootio-github.com/docker/docker to version v28.5.2-root.io.9+incompatible.
- Update docker github.com/docker/docker to version v28.5.3-0.20260325154711-31a1689cb0a1-aikido.1+incompatible.
- Update docker rootio-github.com/docker/docker to version v28.5.3-0.20260325154711-31a1689cb0a1-root.io.1+incompatible.
- Update github.com docker to version 29.3.1 or later.
- Update mobyproject moby to version 29.3.1 or later.
- Update docker engine to version 29.3.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | moby | < 29.3.1 |
| go | github.com | docker | < 29.3.1 |
| go | github.com | moby |
< 2.0.0-beta.8 Fix: upgrade to 2.0.0-beta.8
|
| – | mobyproject | moby |
< 29.3.1 cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:* |
| Go | docker | github.com/docker/docker | All versions |
| Go | moby | github.com/moby/moby | All versions |
| Go | moby | github.com/moby/moby/v2 |
< 2.0.0-beta.8 Fix: upgrade to 2.0.0-beta.8
|
| Root:Go | docker | github.com/docker/docker |
< v28.5.2+incompatible-aikido.4 < v28.5.2-aikido.7+incompatible < v28.5.2-aikido.8+incompatible < v28.5.2-aikido.9+incompatible < v28.5.3-0.20260325154711-31a1689cb0a1-aikido.1+incompatible Fix: upgrade to v28.5.2+incompatible-aikido.4
|
| Debian:11 | debian | docker.io | All versions |
| Debian:12 | debian | docker.io | All versions |
| Debian:13 | debian | docker.io | All versions |
| Debian:14 | debian | docker.io | All versions |
| Root:Go | docker | rootio-github.com/docker/docker |
< v28.5.2-root.io.4+incompatible < v28.5.2-root.io.5+incompatible < v28.5.2+incompatible-root.io.4 < v27.1.1-root.io.3+incompatible < v28.5.2-root.io.9+incompatible < v28.5.3-0.20260325154711-31a1689cb0a1-root.io.1+incompatible Fix: upgrade to v28.5.2-root.io.4+incompatible
|
| – | docker | engine |
< 29.3.1 cpe:2.3:a:docker:engine:*:*:*:*:*:*:*:* |
| Ubuntu:Pro:16.04:LTS | canonical | docker.io | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | docker.io-app | All versions |
Original advisory text
CVE-2026-34040 in github.com/docker/docker - Patched by Root
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.
References
- https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq
- https://github.com/moby/moby/commit/e89edb19ad7de0407a5d31e3111cb01aa10b5a38
- https://github.com/moby/moby/releases/tag/docker-v29.3.1 Third Party Advisory
- https://docs.docker.com/engine/extend/plugins_authorization
- https://github.com/advisories/GHSA-x744-4wpc-v9h2
- https://security-tracker.debian.org/tracker/CVE-2026-34040 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34040... Vendor Advisory
- https://ubuntu.com/security/CVE-2026-34040 Third Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-34040 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-34040 Third Party Advisory
- https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
7.8
High
Type
CWE-863Incorrect Authorization
CWE-288Authentication Bypass Using Alternate Path
Timeline
Published31 Mar 2026
Updated4 Nov 2026
First seen27 Mar 2026
Sources
DEBIAN-CVE-2026-34040 · OSV
GHSA-x744-4wpc-v9h2 · GHSA
CVE-2026-34040 · NVD
GO-2026-4887 · OSV
CVE-2026-34040 · OSV
UBUNTU-CVE-2026-34040 · OSV
Track software like this
Free during beta