Bug 2485356 (CVE-2026-41567)
| Summary: | CVE-2026-41567 docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | agarcial, amctagga, anpicker, aoconnor, aprice, asatyam, asegurap, asyoung, bniver, dfreiber, diagrawa, drow, flucifre, gmeno, gparvin, groman, hasun, jburrell, jfula, jhollowa, jkoehler, jowilson, jsamir, kaycoth, lphiri, mbenjamin, mhackett, mwringe, nyancey, oezr, ometelka, pahickey, prichard, ptisnovs, rhaigner, rhel-process-autobot, sabiswas, sostapov, sthirugn, syedriko, vereddy, vkumar, watson-tool-maintainers, xdharmai |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Moby, the open-source container framework, and Docker Engine. A malicious container image can exploit this vulnerability to achieve arbitrary code execution with full daemon privileges, including host root access. This occurs when a user uploads a compressed archive to the container, as the daemon incorrectly uses decompression binaries from the container's filesystem. This allows an attacker to gain complete control over the affected system.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2493567, 2493574, 2493559, 2493560, 2493561, 2493562, 2493563, 2493564, 2493565, 2493566, 2493568, 2493569, 2493570, 2493571, 2493572, 2493573, 2493575, 2493610 | ||
| Bug Blocks: | |||
Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images