Race Condition in Docker Engine and Moby Daemon Enables Arbitrary File Manipulation
CVE-2026-41568

6.1MEDIUM

Key Information:

Vendor

Moby

Status
Moby
Vendor
CVE Published:
12 June 2026

What is CVE-2026-41568?

A race condition vulnerability exists in Moby and Docker Engine that affects the setup of mounts during the execution of the 'docker cp' command. This flaw allows a malicious container to create empty files or directories at uncontrolled absolute paths on the host's filesystem, potentially leading to unintended overwrites or file disclosures. It is crucial for users to update to the latest versions of Docker Engine and Moby Daemon to mitigate the risks associated with this issue.

Affected Version(s)

moby github.com/docker/docker/daemon <= 28.5.2 <= github.com/docker/docker/daemon 28.5.2

moby Docker Engine < 29.5.1 < Docker Engine 29.5.1

moby github.com/moby/moby/v2/daemon < 2.0.0-beta.14 < github.com/moby/moby/v2/daemon 2.0.0-beta.14

References

https://github.com/moby/moby/security/advisories/GHSA-vp6...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.