CVE-2026-41567
- Source
- https://cve.org/CVERecord?id=CVE-2026-41567
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41567.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-41567
- Aliases
- Downstream
- Related
- Published
- 2026-06-05T00:35:50.563Z
- Modified
- 2026-07-28T04:02:42.640790947Z
- Severity
-
- 7.2 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
- Summary
- Docker: `PUT /containers/{id}/archive` executes container binary on the host
- Details
-
Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via
PUT /containers/{id}/archiveor piped throughdocker cp -, the daemon resolves decompression binaries (such asxzorunpigz) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to thePUT /containers/{id}/archiveendpoint, and avoiding piping compressed archives into containers created from untrusted images - Database specific
{ "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41567.json", "cwe_ids": [ "CWE-427" ] }- References
-
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41567.json
- https://access.redhat.com/errata/RHSA-2026:37387
- https://access.redhat.com/errata/RHSA-2026:41030
- https://access.redhat.com/errata/RHSA-2026:42852
- https://access.redhat.com/errata/RHSA-2026:44622
- https://access.redhat.com/security/cve/CVE-2026-41567
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41567.json
- https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r
- https://nvd.nist.gov/vuln/detail/CVE-2026-41567
- https://bugzilla.redhat.com/show_bug.cgi?id=2485356
Affected packages
Git / github.com/moby/moby
Affected ranges
- Type
- GIT
- Repo
- https://github.com/moby/moby
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "2.0.0-beta.14" }, { "fixed": "29.5.1" }, { "last_affected": "28.5.2" } ], "source": "AFFECTED_FIELD" }