Skip to content
OpenAdvisories

Vendor

moby

57 known vulnerabilities.

Products

BuildKit 27 moby 20 hyperkit 5 sys 1 spdystream 1 go-archive 1 moby/v2/daemon 1 Docker Engine 1 Moby overlay network driver 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.1
    CVE-2026-17106 Public exploit

    Tar extraction in moby/go-archive can write outside the destination directory via link following

    The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical str…

    Docker moby Docker Desktop Docker Sandboxes Debian Ubuntu Go
  • High 7.2
    CVE-2026-41567 Public exploit

    Docker: `PUT /containers/{id}/archive` executes container binary on the host

    Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves de…

    Docker moby moby/v2/daemon docker/daemon Debian Ubuntu Alpine Go
  • High 8.8
    CVE-2026-34040 Public exploit

    Moby: AuthZ plugin bypass with oversized request body

    Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

    moby moby docker.io docker.io Debian Ubuntu Alpine Go
  • Critical 10.0
    CVE-2024-41110 Public exploit EPSS 16%

    Moby authz zero length regression

    Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances…

    moby moby docker.io docker.io Debian Ubuntu Alpine Go
  • Critical 9.8
    CVE-2024-23653 Public exploit

    BuildKit interactive containers API does not validate entitlements check

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It w…

    moby BuildKit docker.io docker Ubuntu Alpine Go
  • Critical 10.0
    CVE-2024-23652 Public exploit

    BuildKit possible host system access from mount stub cleaner

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints i…

    moby BuildKit docker.io docker Ubuntu Alpine Go
  • Medium 6.3
    CVE-2021-41091 Public exploit

    Insufficiently restricted permissions on data directory in Docker Engine

    Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing …

    moby moby docker.io docker.io Debian Ubuntu Alpine Go