Bug 2570819 (CVE-2026-115538)

Summary:	CVE-2026-115538 github.com/moby/moby: Moby: Overlay network encryption bypass via firewall reload
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, amctagga, aoconnor, aos-team-art-private, asdas, bniver, dpaolell, flucifre, gmeno, gparvin, groman, jbalunas, jdelft, jupierce, lchilton, lgarciaa, mbenjamin, mbiarnes, mhackett, ppalepu, ppostler, prdhamdh, rhaigner, rhel-process-autobot, sfeifer, sghai, sidsharm, sostapov, suppawar, tsze, vereddy, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Moby's overlay network driver. When the system firewall service reloads or restarts, the driver fails to restore filtering rules required to enforce network encryption. Consequently, outgoing network traffic that is expected to be encrypted is transmitted in cleartext, and incoming unencrypted traffic is accepted. An attacker with network access could exploit this flaw to intercept sensitive communications or inject unauthorized traffic into the container network.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-10 20:24:35 UTC

Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload or start signals over D-Bus. The missing rules cause outgoing VXLAN datagrams to bypass IPsec encryption and remove the protection against incoming cleartext VXLAN traffic. The condition is not logged by dockerd and persists until the encrypted network's last local endpoint is removed and another is added, or dockerd is restarted. Each further firewalld event repeats the condition.