8.8High

CVE-2026-34040Moby: AuthZ plugin bypass with oversized request body

moby moby Published: 2026-03-31 04:36 (7 months ago)

Description

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

Weakness (CWE): CWE-288

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
docker	engine	< 29.3.1
moby	moby	< 29.3.1

References and patches

https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2 Vendor Advisory
https://github.com/moby/moby/releases/tag/docker-v29.3.1 Release Notes

CPE matches (NVD) (1)

cpe:2.3:a:docker:engine:*:*:*:*:*:*:*:* < 29.3.1

CVSS score

8.8High

Source: GitHub_M · CVSS 3.1

Attack vector: Local
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

All scores (3)

cna	CVSS 3.1	8.8High
security-advisories@github.com	CVSS 3.1	8.8High
nvd	CVSS 3.1	7.8High

EPSS (chance of exploitation in 30 days)

9.27%

higher than 95% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: total

Timeline

ID reserved2026-03-25
Published2026-03-31 04:36
Reached IP-DB2026-10-24 23:47
Last updated2026-06-17 13:38

Assigned by (CNA): GitHub_M
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Docker / Moby

7.3High

CVE-2026-126329 yesterday

Docker Sandboxes privilege escalation through untrusted state directories

Docker Docker Sandboxes

Docker Sandboxes reuses existing state and configuration directories without verifying their ownership. If sbx or sandboxd is run as root with HOME or, on Linux, XDG_STATE_HOME pointing to an attacker-controlled location, a local unprivileged user can substit…

2.4Low

CVE-2026-126330 yesterday

Docker Sandboxes restores removed automatically assigned port publications

Docker Docker Sandboxes

Docker Sandboxes can silently republish a sandbox service after an operator removes its automatically assigned host-port mapping. The daemon removes the active binding but retains the original publication request, allowing a later port change or sandbox resta…

5.7Medium

CVE-2026-123082 3 days ago

Docker Desktop logs can expose the Docker Hub access token

Docker Docker Desktop

Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token (a JWT) in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before logging, and a Docker D…

4.5Medium

CVE-2026-121520 9 days ago

Malicious client could set xattr value outside of BuildKit state directory

Moby BuildKit

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. name…

6.7Medium

CVE-2026-121522 9 days ago

Possible panic from Git source resolver

moby BuildKit

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.

5.6Medium

CVE-2026-121541 9 days ago

Bake filesystem path entitlements approval can be skipped in some multi-target builds

Docker Docker Buildx

In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some …