Bug 2485356 (CVE-2026-41567)

Summary: CVE-2026-41567 docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: agarcial, amctagga, anpicker, aoconnor, aprice, asatyam, asegurap, asyoung, bniver, dfreiber, diagrawa, drow, flucifre, gmeno, gparvin, groman, hasun, jburrell, jfula, jhollowa, jkoehler, jowilson, jsamir, kaycoth, lphiri, mbenjamin, mhackett, mwringe, nyancey, oezr, ometelka, pahickey, prichard, ptisnovs, rhaigner, rhel-process-autobot, sabiswas, sostapov, sthirugn, syedriko, vereddy, vkumar, watson-tool-maintainers, xdharmai
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Moby, the open-source container framework, and Docker Engine. A malicious container image can exploit this vulnerability to achieve arbitrary code execution with full daemon privileges, including host root access. This occurs when a user uploads a compressed archive to the container, as the daemon incorrectly uses decompression binaries from the container's filesystem. This allows an attacker to gain complete control over the affected system.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2493567, 2493574, 2493559, 2493560, 2493561, 2493562, 2493563, 2493564, 2493565, 2493566, 2493568, 2493569, 2493570, 2493571, 2493572, 2493573, 2493575, 2493610    
Bug Blocks:    

Description OSIDB Bzimport 2026-06-05 02:01:17 UTC
Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images