CVE-2026-41568

Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 4.7

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/moby/moby/security/advisories/GHSA-vp62-88p7-qqf5	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:docker:engine::::::::
	cpe:2.3:a:mobyproject:moby::::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta0::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta1::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta10::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta11::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta12::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta13::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta2::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta3::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta4::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta5::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta6::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta7::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta8::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta9::::::

History

No history.

Information

Published : 2026-06-12 19:16

Updated : 2026-06-17 10:46

NVD link : CVE-2026-41568

Mitre link : CVE-2026-41568

CVE.ORG link : CVE-2026-41568

JSON object : View

Products Affected

docker

engine

mobyproject

moby\/v2
moby

CWE

CWE-81

Improper Neutralization of Script in an Error Message Web Page

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

{"id": "CVE-2026-41568", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41568", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-12T20:01:52.180826Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.7, "exploitabilityScore": 0.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "moby", "product": "moby", "versions": [{"status": "affected", "version": "github.com/docker/docker/daemon <= 28.5.2"}, {"status": "affected", "version": "Docker Engine < 29.5.1"}, {"status": "affected", "version": "github.com/moby/moby/v2/daemon < 2.0.0-beta.14"}]}]}], "published": "2026-06-12T19:16:26.907", "references": [{"url": "https://github.com/moby/moby/security/advisories/GHSA-vp62-88p7-qqf5", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-81"}, {"lang": "en", "value": "CWE-367"}]}], "descriptions": [{"lang": "en", "value": "Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14."}], "lastModified": "2026-06-17T10:46:51.787", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:docker:engine:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0387267D-1C09-445D-8DE5-EBF7ED5D8DA7", "versionEndExcluding": "29.5.1"}, {"criteria": "cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13145CF0-6F92-4618-9D3B-7CC2BF2093AD", "versionEndIncluding": "28.5.2"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta0:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "41E96E86-7594-4167-B07C-88D160E55342"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A64F5FE0-916E-4204-ABEE-1F7A35318411"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6BDD2BEB-8FED-445D-917C-20032175523D"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta11:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2EB749A6-2846-416F-8F34-B9E367CB339B"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta12:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62AB7D16-0C2C-4C2C-883E-FDCE44BFCF7E"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta13:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D87928A4-5851-4FEC-8623-E156967B2BB8"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96A4B37B-E3A1-495F-A9CD-FB64450A3C4C"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "197109A1-5D87-4A71-B533-D4C290471B77"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C92B17E7-7C0C-437E-8CE7-D8D110992196"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3A71A9E-CEBB-4494-B5AF-A22B4AC59240"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7D288EB-1234-45BC-877C-52424291A8CD"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "42DE84CD-889E-4EBE-B23E-D7774DF2DFDF"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "71BE8BC1-B8CF-4390-B743-F9415BF45C01"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB767A77-2F36-49D6-8DD6-C66000BA59CC"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}