CVE-2026-33997

EUVD-2026-17290

31.03.2026, 03:15

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.8 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 31.72%

Affected Products (NVD)

Vendor	Product	Version
docker	engine	𝑥 < 29.3.1

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Red Hat	Multicluster Global Hub 1.4.5	1779579439 ≤ 𝑥 < *	ADP
Red Hat	Red Hat multicluster global hub 1.5.0	1778867753 ≤ 𝑥 < *	ADP
Red Hat	Red Hat multicluster global hub 1.6.0	1780167118 ≤ 𝑥 < *	ADP