Skip to content
OpenAdvisories

Package · Go

github.com/docker/docker

36 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 7.2
    CVE-2026-42306

    Moby: Race condition in docker cp allows bind mount redirection to host path

    Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redire…

    moby moby docker.io docker.io Debian Ubuntu Go
  • High 7.2
    CVE-2026-41567 Public exploit

    Docker: `PUT /containers/{id}/archive` executes container binary on the host

    Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves de…

    Docker moby Docker Engine moby/v2/daemon Debian Ubuntu Alpine Go
  • High 8.8
    CVE-2026-34040 Public exploit

    Moby: AuthZ plugin bypass with oversized request body

    Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

    moby moby docker.io docker.io Debian Ubuntu Alpine Go
  • High 7.5
    CVE-2023-28840

    moby/moby's dockerd daemon encrypted overlay network may be unauthenticated

    Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby, is commonly …

    moby moby docker.io docker.io Debian Ubuntu Alpine Go
  • High 7.5
    CVE-2019-13509

    Secret insertion into debug log in Docker

    In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a sta…

    docker.io docker github.com/docker/docker Debian Alpine Go
  • High 7.5
    CVE-2018-12608

    Docker Authentication Bypass

    An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certi…

    docker.io docker.io github.com/docker/docker Debian Ubuntu Go
  • High 8.4
    CVE-2015-3630

    Information Exposure in Docker Engine

    Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a cr…

    docker.io docker.io github.com/docker/docker Debian Ubuntu Go
  • High 8.4
    CVE-2015-3629

    Arbitrary File Write in Libcontainer

    Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.

    docker.io docker.io github.com/docker/docker Debian Ubuntu Go
  • High 7.3
    CVE-2014-6407

    Arbitrary Code Execution in Docker

    Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.

    docker.io github.com/docker/docker Debian Go
  • High 8.4
    CVE-2014-3499

    Privilege Escalation in Docker

    Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

    github.com/docker/docker Go