CVE-2026-42306

CVE Enrichment

CVSS: 7.2 HIGH
EPSS: 0.10%
EPSS Percentile: 1.04%
CISA KEV: Not listed

Description

Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 13-Jun-2026 02:16
Last Modified: 17-Jun-2026 17:47
EPSS Date: 2026-11-06
CWE: CWE-61, CWE-367

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:H /
                            PR:L /
                            UI:R /
                            S:C /
                            C:N /
                            I:H /
                            A:H

CNA Products / Version Status

moby · moby Source: CNA · [email protected]
Default status: unknown

github.com/docker/docker/daemon <= 28.5.2 — affected
Docker Engine < 29.5.1 — affected
github.com/moby/moby/v2/daemon < 2.0.0-beta.14 — affected

Affected Products / Versions

docker / engine Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 29.5.1
cpe:2.3:a:docker:engine:*:*:*:*:*:*:*:*
mobyproject / moby Source: NVD CPE · affected
Version / affected range: * · through (inclusive) 28.5.2
cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:*
mobyproject / moby\/v2 Source: NVD CPE · affected
Version / affected range: 2.0.0
cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta0:*:*:*:*:*:*
mobyproject / moby\/v2 Source: NVD CPE · affected
Version / affected range: 2.0.0
cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta1:*:*:*:*:*:*
mobyproject / moby\/v2 Source: NVD CPE · affected
Version / affected range: 2.0.0
cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta10:*:*:*:*:*:*
mobyproject / moby\/v2 Source: NVD CPE · affected
Version / affected range: 2.0.0
cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta11:*:*:*:*:*:*
mobyproject / moby\/v2 Source: NVD CPE · affected
Version / affected range: 2.0.0
cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta12:*:*:*:*:*:*
mobyproject / moby\/v2 Source: NVD CPE · affected
Version / affected range: 2.0.0
cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta13:*:*:*:*:*:*
mobyproject / moby\/v2 Source: NVD CPE · affected
Version / affected range: 2.0.0
cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta2:*:*:*:*:*:*
mobyproject / moby\/v2 Source: NVD CPE · affected
Version / affected range: 2.0.0
cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta3:*:*:*:*:*:*
mobyproject / moby\/v2 Source: NVD CPE · affected
Version / affected range: 2.0.0
cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta4:*:*:*:*:*:*
mobyproject / moby\/v2 Source: NVD CPE · affected
Version / affected range: 2.0.0
cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta5:*:*:*:*:*:*
mobyproject / moby\/v2 Source: NVD CPE · affected
Version / affected range: 2.0.0
cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta6:*:*:*:*:*:*
mobyproject / moby\/v2 Source: NVD CPE · affected
Version / affected range: 2.0.0
cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta7:*:*:*:*:*:*
mobyproject / moby\/v2 Source: NVD CPE · affected
Version / affected range: 2.0.0
cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta8:*:*:*:*:*:*
mobyproject / moby\/v2 Source: NVD CPE · affected
Version / affected range: 2.0.0
cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta9:*:*:*:*:*:*

References

[email protected]

Last enrichment sync: 06-Nov-2026 23:13
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Docker fixed archive and mount-handling flaws in CVE-2026-41567, CVE-2026-41568, and CVE-2026-42306. Misconfigurations Enabled Ransomware Attacks on ESXi and Proxmox

CVE (5)

Malware (1)

Threat Actors (1)

MITRE ATT&CK (8)

Vendors (2)

Products (6)

Tools (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.