Vulnerability-Lookup

FKIE_CVE-2026-42306

Vulnerability from fkie_nvd - Published: 2026-06-12 19:16 - Updated: 2026-06-16 18:31

Severity

7.2 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H
7.2 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H

Summary

Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.

References

	URL	Tags
	security-advisories@github.com	https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh	Mitigation, Vendor Advisory

Impacted products

Vendor	Product	Version
docker	engine	*
mobyproject	moby	*
mobyproject	moby\/v2	2.0.0
mobyproject	moby\/v2	2.0.0
mobyproject	moby\/v2	2.0.0
mobyproject	moby\/v2	2.0.0
mobyproject	moby\/v2	2.0.0
mobyproject	moby\/v2	2.0.0
mobyproject	moby\/v2	2.0.0
mobyproject	moby\/v2	2.0.0
mobyproject	moby\/v2	2.0.0
mobyproject	moby\/v2	2.0.0
mobyproject	moby\/v2	2.0.0
mobyproject	moby\/v2	2.0.0
mobyproject	moby\/v2	2.0.0
mobyproject	moby\/v2	2.0.0

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:docker:engine:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0387267D-1C09-445D-8DE5-EBF7ED5D8DA7",
              "versionEndExcluding": "29.5.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "13145CF0-6F92-4618-9D3B-7CC2BF2093AD",
              "versionEndIncluding": "28.5.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta0:*:*:*:*:*:*",
              "matchCriteriaId": "41E96E86-7594-4167-B07C-88D160E55342",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "A64F5FE0-916E-4204-ABEE-1F7A35318411",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta10:*:*:*:*:*:*",
              "matchCriteriaId": "6BDD2BEB-8FED-445D-917C-20032175523D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta11:*:*:*:*:*:*",
              "matchCriteriaId": "2EB749A6-2846-416F-8F34-B9E367CB339B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta12:*:*:*:*:*:*",
              "matchCriteriaId": "62AB7D16-0C2C-4C2C-883E-FDCE44BFCF7E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta13:*:*:*:*:*:*",
              "matchCriteriaId": "D87928A4-5851-4FEC-8623-E156967B2BB8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "96A4B37B-E3A1-495F-A9CD-FB64450A3C4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "197109A1-5D87-4A71-B533-D4C290471B77",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta4:*:*:*:*:*:*",
              "matchCriteriaId": "C92B17E7-7C0C-437E-8CE7-D8D110992196",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta5:*:*:*:*:*:*",
              "matchCriteriaId": "D3A71A9E-CEBB-4494-B5AF-A22B4AC59240",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta6:*:*:*:*:*:*",
              "matchCriteriaId": "A7D288EB-1234-45BC-877C-52424291A8CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta7:*:*:*:*:*:*",
              "matchCriteriaId": "42DE84CD-889E-4EBE-B23E-D7774DF2DFDF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta8:*:*:*:*:*:*",
              "matchCriteriaId": "71BE8BC1-B8CF-4390-B743-F9415BF45C01",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta9:*:*:*:*:*:*",
              "matchCriteriaId": "CB767A77-2F36-49D6-8DD6-C66000BA59CC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14."
    }
  ],
  "id": "CVE-2026-42306",
  "lastModified": "2026-06-16T18:31:31.120",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 5.8,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 5.8,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-06-12T19:16:27.490",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-61"
        },
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

CVE-2026-42306 (GCVE-0-2026-42306)

Vulnerability from cvelistv5 – Published: 2026-06-12 18:09 – Updated: 2026-06-13 03:25

Title

Moby: Race condition in docker cp allows bind mount redirection to host path

Summary

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-61 - UNIX Symbolic Link (Symlink) Following
CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/moby/moby/security/advisories/…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
moby	moby	Affected: github.com/docker/docker/daemon <= 28.5.2 Affected: Docker Engine < 29.5.1 Affected: github.com/moby/moby/v2/daemon < 2.0.0-beta.14

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42306",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-13T03:25:35.429147Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-13T03:25:47.055Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moby",
          "vendor": "moby",
          "versions": [
            {
              "status": "affected",
              "version": "github.com/docker/docker/daemon \u003c= 28.5.2"
            },
            {
              "status": "affected",
              "version": "Docker Engine \u003c 29.5.1"
            },
            {
              "status": "affected",
              "version": "github.com/moby/moby/v2/daemon \u003c 2.0.0-beta.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-61",
              "description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-12T18:09:22.188Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh"
        }
      ],
      "source": {
        "advisory": "GHSA-rg2x-37c3-w2rh",
        "discovery": "UNKNOWN"
      },
      "title": "Moby: Race condition in docker cp allows bind mount redirection to host path"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42306",
    "datePublished": "2026-06-12T18:09:22.188Z",
    "dateReserved": "2026-04-26T12:37:18.169Z",
    "dateUpdated": "2026-06-13T03:25:47.055Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2026-42306

CVE-2026-42306 (GCVE-0-2026-42306)

Tags

Sightings

Nomenclature