cyber.hendryadrian.com

CVE

CVE-2026-41567

docker · docker/daemon; moby · Docker Engine; +18 more

First Reported
Nov 6, 2026
Latest Reported
Nov 6, 2026
Articles
1
View articles →
IOC
0
View indicators →

CVE Enrichment

CVSS
7.2 HIGH
EPSS
0.16%
EPSS Percentile
4.67%
CISA KEV
Not listed

Description

Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images

Technical Details

CVSS Version
3.1
CNA / NVD Source
[email protected]
Published
05-Jun-2026 09:17
Last Modified
09-Sep-2026 20:19
EPSS Date
2026-11-06
CWE
CWE-427

CVSS Vector

CVSS:3.1 AV:L / AC:H / PR:L / UI:R / S:C / C:H / I:H / A:N

CNA Products / Version Status

References

Last enrichment sync: 06-Nov-2026 23:07
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE (5)

CVE-2024-21626opencontainers · runc; Red Hat · OCP-Tools-4.15-RHEL-8; +25 more1 related articleCVE-2025-22224Vmware · Cloud foundation; Vmware · Esxi; +3 more1 related articleCVE-2026-31431Linux · Linux; Red Hat · NVIDIA for RHEL 10; +95 more1 related articleCVE-2026-41568moby · moby1 related articleCVE-2026-42306moby · moby1 related article

Malware (1)

BlackNevas1 related article

Threat Actors (1)

The Gentlemen group1 related article

MITRE ATT&CK (8)

T1021.0041 related articleT1021.0051 related articleT1059.0041 related articleT10781 related articleT11051 related articleT14861 related articleT1552.0011 related articleT1562.0011 related article

Vendors (2)

Broadcom1 related articleKaspersky1 related article

Products (6)

Docker Engine1 related articleESXi1 related articlePaessler PRTG1 related articlePortainer1 related articleProxmox1 related articleVMware vCenter Server1 related article

Tools (3)

AnyDesk1 related articleesxcli1 related articleGMER1 related article

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.