Race Condition Vulnerability in Moby Framework and Docker Engine
CVE-2026-42306

7.2HIGH

Key Information:

Vendor

Moby

Status
Moby
Vendor
CVE Published:
12 June 2026

What is CVE-2026-42306?

A race condition vulnerability has been identified in the Moby framework and Docker Engine, which can be exploited during the setup of a bind mount using the docker cp command. This flaw allows a malicious container to manipulate the bind mount target, potentially redirecting it to an arbitrary path on the host system. Such an exploit could lead to serious consequences, including overwriting critical host files or causing a denial of service. This vulnerability was effectively addressed in the released patches for Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.

Affected Version(s)

moby github.com/docker/docker/daemon <= 28.5.2 <= github.com/docker/docker/daemon 28.5.2

moby Docker Engine < 29.5.1 < Docker Engine 29.5.1

moby github.com/moby/moby/v2/daemon < 2.0.0-beta.14 < github.com/moby/moby/v2/daemon 2.0.0-beta.14

References

https://github.com/moby/moby/security/advisories/GHSA-rg2...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.