Security Flaw in Docker Engine Affects Registry Connection

CVE-2026-92543

What is CVE-2026-92543?

A security vulnerability in Docker Engine occurs when it erroneously classifies a registry hostname as insecure due to an any-match DNS check. The loadInsecureRegistries() function by default injects loopback addresses as insecure CIDRs. Consequently, the isCIDRMatch function resolves all addresses of the hostname and returns true if any match the insecure list. This process allows the transport mechanism to revert to insecure connections, thus circumventing certificate verification and enabling HTTP fallback, which may expose the system to potential exploits and unauthorized access.

References