Network Overlay Vulnerability in Moby's Driver for Docker Engine

CVE-2026-115538

What is CVE-2026-115538?

The Moby overlay network driver for Docker Engine has a vulnerability that prevents the restoration of iptables rules for encrypted overlay networks when firewalld deletes them. Unlike other networking components, the overlay driver does not manage firewalld reload or start signals via D-Bus, leading to a scenario where outgoing VXLAN datagrams can bypass IPsec encryption. This flaw exposes encrypted networks to potential security risks, allowing incoming cleartext VXLAN traffic without proper logging by dockerd. The vulnerability persists until the last local endpoint of the encrypted network is removed or dockerd is restarted, making it crucial to address any firewalld events promptly.

References