cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Docker Engine Flaw Can Bypass Authorization Plugins and Enable Host Access

· Original article ↗

Summary

CVE-2026-34040 lets a padded HTTP request bypass Docker Engine authorization plugins, potentially enabling privileged container creation and host access. Docker fixed the flaw in version 29.3.1; recommended workarounds include restricting API access and rootless mode.

Key points

  • CVE-2026-34040 (CVSS 8.8) affects Docker Engine and is described as an incomplete fix for CVE-2024-41110.
  • A padded HTTP request exceeding 1 MB can cause the daemon to forward a request without its body to an authorization plugin.
  • If the plugin relies on inspecting the body, it may allow a request that the daemon then processes, potentially creating a privileged container with host filesystem access.
  • The article describes AI coding agents as potentially being tricked into constructing the request or generating it autonomously; these are attack scenarios, not reported incidents.
  • Docker Engine 29.3.1 fixes the vulnerability.
  • Recommended workarounds include avoiding body-dependent authorization decisions, limiting Docker API access, running Docker rootless, or using user namespace remapping.

Article Details

Vulnerability Types
  • Authorization plugin bypass caused by an oversized HTTP request body being dropped before plugin inspection
Severity
High (CVSS 8.8)
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Avoid authorization plugins that rely on request-body inspection for access-control decisions.
  • Limit Docker API access to trusted parties using the principle of least privilege.
  • Run Docker in rootless mode.
  • Use --userns-remap for similar UID mapping when rootless mode is not feasible.

MITRE ATT&CK

T1611 · Escape to HostThe bypass can allow creation of a privileged container that mounts the host filesystem and provides host access.

CVE

CVE-2024-41110docker · moby; moby · mobyThe vulnerability — an incomplete fix for CVE-2024-41110 — can enable creation of privileged containers with host filesystem access and has been fixed in Docker Engine 29.3.1; mitigations include avoidingCVE-2026-34040moby · mobyA high-severity flaw in Docker Engine (CVE-2026-34040) allows attackers to bypass authorization plugins by sending a specially crafted, padded HTTP request that causes the daemon to forward requests without the body.

People

Asim ManizadaCredited with independently discovering and reporting CVE-2026-34040.CodyCredited with independently discovering and reporting CVE-2026-34040.Oleh KonkoCredited with independently discovering and reporting CVE-2026-34040.Vladimir TokarevCredited with independently discovering and reporting CVE-2026-34040; he also reported technical details of the vulnerability through Cyera Research Labs.

Vendors

DockerA high-severity flaw in Docker Engine (CVE-2026-34040) allows attackers to bypass authorization plugins by sending a specially crafted, padded HTTP request that causes the daemon to forward requests without the body.

Products

Docker EngineA high-severity flaw in Docker Engine (CVE-2026-34040) allows attackers to bypass authorization plugins by sending a specially crafted, padded HTTP request that causes the daemon to forward requests without the body.OpenClawAI coding agents like OpenClaw can be tricked or may autonomously construct the padded request, allowing exploitation without explicit exploit code.

Related Articles