IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
6.1Mittel

CVE-2026-41568Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap

moby moby Veröffentlicht: (vor 4 Monaten)

Beschreibung

Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.

Schwachstellentyp (CWE): CWE-81CWE-367

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
docker engine < 29.5.1
moby moby github.com/docker/docker/daemon <= 28.5.2, Docker Engine < 29.5.1, github.com/moby/moby/v2/daemon < 2.0.0-beta.14
mobyproject moby ≤ 28.5.2
mobyproject moby/v2 2.0.0

Referenzen und Patches

CPE-Treffer (NVD) (16)
  • cpe:2.3:a:docker:engine:*:*:*:*:*:*:*:* < 29.5.1
  • cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:* ≤ 28.5.2
  • cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta0:*:*:*:*:*:*
  • cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta1:*:*:*:*:*:*
  • cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta10:*:*:*:*:*:*
  • cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta11:*:*:*:*:*:*
  • cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta12:*:*:*:*:*:*
  • cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta13:*:*:*:*:*:*
  • cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta2:*:*:*:*:*:*
  • cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta3:*:*:*:*:*:*
  • cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta4:*:*:*:*:*:*
  • cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta5:*:*:*:*:*:*
  • cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta6:*:*:*:*:*:*
  • cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta7:*:*:*:*:*:*
  • cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta8:*:*:*:*:*:*
  • cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta9:*:*:*:*:*:*

Neue CVEs im selben Produkt — Docker / Moby

6.7Mittel
CVE-2026-121522

Possible panic from Git source resolver

moby BuildKit

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.