CVE-2026-41567

EUVD-2026-34779
Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.2 HIGH
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 5.57%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatMulticluster Global Hub 1.5.6
1784562060 ≤
𝑥
< *
ADP
Red HatOpenShift Developer Tools and Services 1.6.2
1784727697 ≤
𝑥
< *
ADP
Red HatOpenShift Developer Tools and Services 1.6.2
1784728036 ≤
𝑥
< *
ADP
Red HatRed Hat multicluster global hub 1.4.2
1784060681 ≤
𝑥
< *
ADP
Red HatRed Hat multicluster global hub 1.6.0
1784561376 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1782932114 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1782931768 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1782932104 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1783536000 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1783535989 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1783536515 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1782932521 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1783018461 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1783018421 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1782932812 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1783537001 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1782932919 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1783537586 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1782932969 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1782933015 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1782933042 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1783537392 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1782933235 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1782933251 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1783537955 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1782933417 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1783537742 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1782933602 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1783019377 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1782934054 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1782934036 ≤
𝑥
< *
ADP
Red HatRed Hat Openshift Data Foundation 4.22
1782934284 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
docker.io
bookworm
vulnerable
forky
28.5.2+dfsg4-4
fixed
sid
28.5.2+dfsg4-4
fixed
trixie
vulnerable
trixie (security)
26.1.5+dfsg1-9+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
docker.io
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
xenial
needs-triage
docker.io-app
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
docker-buildx
suse enterprise desktop 15 SP7
0.33.0-150000.253.1
fixed
suse enterprise sap 15 SP4
0.33.0-150000.253.1
fixed
suse enterprise sap 15 SP5
0.33.0-150000.253.1
fixed
suse enterprise sap 15 SP6
0.33.0-150000.253.1
fixed
suse enterprise sap 15 SP7
0.33.0-150000.253.1
fixed
suse enterprise server 15 SP4
0.33.0-150000.253.1
fixed
suse enterprise server 15 SP5
0.33.0-150000.253.1
fixed
suse enterprise server 15 SP6
0.33.0-150000.253.1
fixed
suse enterprise server 15 SP7
0.33.0-150000.253.1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
docker
Amazon Linux 2023
0:25.0.16-1.amzn2023.0.3
fixed
docker-debuginfo
Amazon Linux 2023
0:25.0.16-1.amzn2023.0.3
fixed
docker-debugsource
Amazon Linux 2023
0:25.0.16-1.amzn2023.0.3
fixed
Common Weakness Enumeration
References
https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r
https://access.redhat.com/errata/RHSA-2026:37387
https://access.redhat.com/errata/RHSA-2026:41030
https://access.redhat.com/errata/RHSA-2026:42852
https://access.redhat.com/errata/RHSA-2026:44622
https://access.redhat.com/errata/RHSA-2026:51057
https://access.redhat.com/security/cve/CVE-2026-41567
https://bugzilla.redhat.com/show_bug.cgi?id=2485356
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41567.json