CVE-2026-92542

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-92542
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92542.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-92542
Aliases
  • GHSA-6m9p-4h64-m6vh
Downstream
Published
2026-10-07T16:42:20Z
Modified
2026-10-09T02:30:48Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Blind VXLAN injection into encrypted overlay networks from cluster peer
Details

The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encrypted with the overlay-network IPsec parameters which meets the following criteria:

  • UDP datagram
  • Destination port is the Swarm data-path port
  • Datagram starts with a VXLAN header for the VNI of an encrypted overlay network which any running container on the node is connected to
Database specific 
{
    "cna_assigner": "Docker",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92542.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "25.0.19"
                },
                {
                    "fixed": "v25.0.19"
                },
                {
                    "introduced": "v26.0.0"
                },
                {
                    "fixed": "*"
                },
                {
                    "introduced": "v2.0.0-beta.0"
                },
                {
                    "fixed": "v2.0.0-beta.25"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/moby/moby

Affected ranges

Type
GIT
Repo
https://github.com/moby/moby
Events
Introduced
8b79278316b532d396048bc8c2fa015a85d53a53
Fixed
8af9fe3a36bab3e039862a2ab1cef1880c9b4d03
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "26.0.0"
        },
        {
            "fixed": "29.8.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

api/v1.*
api/v1.52.0
api/v1.52.0-alpha.0
api/v1.52.0-alpha.1
api/v1.52.0-beta.0
api/v1.52.0-beta.1
api/v1.52.0-beta.2
api/v1.52.0-beta.3
api/v1.52.0-beta.4
api/v1.52.0-rc.1
client/v0.*
client/v0.1.0
client/v0.1.0-alpha.0
client/v0.1.0-beta.0
client/v0.1.0-beta.1
client/v0.1.0-beta.2
client/v0.1.0-beta.3
client/v0.1.0-rc.1
docker-v29.*
docker-v29.0.0
docker-v29.0.0-rc.1
docker-v29.0.0-rc.2
docker-v29.0.0-rc.3
docker-v29.0.1
docker-v29.0.2
docker-v29.0.3
docker-v29.0.4
docker-v29.1.3
docker-v29.1.4
docker-v29.1.5
docker-v29.3.1
docker-v29.4.2
docker-v29.4.3
docker-v29.6.1
docker-v29.6.2
v2.*
v2.0.0-beta.0
v2.0.0-beta.1
v2.0.0-beta.2
v2.0.0-beta.3
v2.0.0-beta.8
v26.*
v26.0.0
v26.1.0
v27.*
v27.0.0-rc.1
v27.0.0-rc.2
v27.0.1
v27.0.1-rc.1
v28.*
v28.0.0
v28.0.0-rc.1
v28.0.0-rc.2
v28.0.0-rc.3
v28.0.1
v28.0.2
v28.0.3
v28.0.4
v28.1.0
v28.1.0-rc.1
v28.1.0-rc.2
v28.1.1
v28.2.0
v28.2.0-rc.1
v28.2.0-rc.2
v28.2.1
v28.2.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92542.json"