Vulnerability Report

CVE-2026-41567

Title: Moby/Docker Container Host RCE

Other

Proof Of Concept

PoC Available for CVE-2026-41567

CWE Category CWE-427

Published Date Jun 05, 2026

Modified Date Sep 09, 2026

Exploit Status Available

Score 7.2 CVSS v3.1

Exploit Probability (EPSS)

0.16%

Vulnerability Summary

CVE-2026-41567: Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images

Impacted Vendors

Analysis in Progress...

Reference Links

https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r

CVSS v3.1

Source Entity [email protected]

Severity HIGH

7.2

Attack Vector

LOCAL

Complexity

HIGH

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

CVSS v3.1

Source Entity 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Severity HIGH

7.5

Attack Vector

LOCAL

Complexity

HIGH

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-41567 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/berdav/CVE-2026-41567

View Code

September 09, 2026 MODIFIED

Vulnerability data updated via NVD.

September 07, 2026 MODIFIED

Vulnerability data updated via NVD.

September 04, 2026 MODIFIED

Vulnerability data updated via NVD.

August 24, 2026 MODIFIED

Vulnerability data updated via NVD.

August 20, 2026 MODIFIED

Vulnerability data updated via NVD.

August 17, 2026 MODIFIED

Vulnerability data updated via NVD.

August 14, 2026 MODIFIED

Vulnerability data updated via NVD.

August 10, 2026 MODIFIED

Vulnerability data updated via NVD.

August 06, 2026 MODIFIED

Vulnerability data updated via NVD.

August 03, 2026 MODIFIED

Vulnerability data updated via NVD.

July 30, 2026 MODIFIED

Vulnerability data updated via NVD.

July 27, 2026 MODIFIED

Vulnerability data updated via NVD.

July 24, 2026 MODIFIED

Vulnerability data updated via NVD.

July 23, 2026 MODIFIED

Vulnerability data updated via NVD.

July 22, 2026 MODIFIED

Vulnerability data updated via NVD.

July 21, 2026 MODIFIED

Vulnerability data updated via NVD.

July 20, 2026 MODIFIED

Vulnerability data updated via NVD.

July 17, 2026 MODIFIED

Vulnerability data updated via NVD.

July 15, 2026 MODIFIED

Vulnerability data updated via NVD.

July 10, 2026 MODIFIED

Vulnerability data updated via NVD.

July 06, 2026 MODIFIED

Vulnerability data updated via NVD.

June 30, 2026 MODIFIED

Vulnerability data updated via NVD.

June 30, 2026 MODIFIED

Vulnerability data updated via NVD.

June 05, 2026 MODIFIED

Vulnerability data updated via NVD.

June 05, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector LOCAL

Complexity HIGH

Privileges N/A

Interaction REQUIRED

CVSS Vector String


                                    CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Affected Stack

No specific products linked.