Bug 2547588 (CVE-2026-92542)

Summary: CVE-2026-92542 github.com/moby/moby: Moby: Unauthorized traffic injection via forged VXLAN datagrams
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akhatavk, amctagga, aoconnor, aos-team-art-private, asdas, bniver, dpaolell, flucifre, gmeno, gparvin, groman, jbalunas, jdelft, jupierce, lchilton, lgarciaa, mbenjamin, mbiarnes, mhackett, ppalepu, ppostler, prdhamdh, rhaigner, rhel-process-autobot, sfeifer, sghai, sidsharm, sostapov, suppawar, tsze, vereddy, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Moby. Firewall rules for encrypted Swarm overlay networks fail to distinguish between authentic kernel traffic and packets crafted by user processes. A local attacker can exploit this flaw by sending forged Virtual Extensible LAN (VXLAN) datagrams matching the overlay network configuration, causing the host to encrypt and route the traffic. This issue allows an attacker to inject unauthorized traffic into secure container networks, leading to network data tampering and a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-07 16:51:48 UTC 
The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encrypted with the overlay-network IPsec parameters which meets the following criteria:

- UDP datagram
- Destination port is the Swarm data-path port
- Datagram starts with a VXLAN header for the VNI of an encrypted overlay network which any running container on the node is connected to