CVE-2026-42306

Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 0.8 / Impact : 5.8

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:docker:engine::::::::
	cpe:2.3:a:mobyproject:moby::::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta0::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta1::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta10::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta11::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta12::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta13::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta2::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta3::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta4::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta5::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta6::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta7::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta8::::::
	cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta9::::::

History

No history.

Information

Published : 2026-06-12 19:16

Updated : 2026-06-17 10:47

NVD link : CVE-2026-42306

Mitre link : CVE-2026-42306

CVE.ORG link : CVE-2026-42306

JSON object : View

Products Affected

docker

engine

mobyproject

moby\/v2
moby

CWE

CWE-61

UNIX Symbolic Link (Symlink) Following

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

{"id": "CVE-2026-42306", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42306", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-13T03:25:35.429147Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.8, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.8, "exploitabilityScore": 0.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "moby", "product": "moby", "versions": [{"status": "affected", "version": "github.com/docker/docker/daemon <= 28.5.2"}, {"status": "affected", "version": "Docker Engine < 29.5.1"}, {"status": "affected", "version": "github.com/moby/moby/v2/daemon < 2.0.0-beta.14"}]}]}], "published": "2026-06-12T19:16:27.490", "references": [{"url": "https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-61"}, {"lang": "en", "value": "CWE-367"}]}], "descriptions": [{"lang": "en", "value": "Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14."}], "lastModified": "2026-06-17T10:47:39.960", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:docker:engine:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0387267D-1C09-445D-8DE5-EBF7ED5D8DA7", "versionEndExcluding": "29.5.1"}, {"criteria": "cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13145CF0-6F92-4618-9D3B-7CC2BF2093AD", "versionEndIncluding": "28.5.2"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta0:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "41E96E86-7594-4167-B07C-88D160E55342"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A64F5FE0-916E-4204-ABEE-1F7A35318411"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6BDD2BEB-8FED-445D-917C-20032175523D"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta11:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2EB749A6-2846-416F-8F34-B9E367CB339B"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta12:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62AB7D16-0C2C-4C2C-883E-FDCE44BFCF7E"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta13:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D87928A4-5851-4FEC-8623-E156967B2BB8"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96A4B37B-E3A1-495F-A9CD-FB64450A3C4C"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "197109A1-5D87-4A71-B533-D4C290471B77"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C92B17E7-7C0C-437E-8CE7-D8D110992196"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3A71A9E-CEBB-4494-B5AF-A22B4AC59240"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7D288EB-1234-45BC-877C-52424291A8CD"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "42DE84CD-889E-4EBE-B23E-D7774DF2DFDF"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "71BE8BC1-B8CF-4390-B743-F9415BF45C01"}, {"criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB767A77-2F36-49D6-8DD6-C66000BA59CC"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}