Skip to content
OpenAdvisories
Medium · 6.8 CVE-2026-33997 EUVD-2026-17290GHSA-pxq6-2prw-chj9GO-2026-4883

Moby: Off-by-one error in plugin privilege validation

Published Mar 31, 2026 · Updated Sep 9, 2026 · Assigned by GitHub_M

Vendor: moby Product: moby Package: amazon-cloudwatch-agent Package: amazon-cloudwatch-agent-operator Package: apko Package: aws-otel-collector Package: buf Package: buildah Package: cluster-api-1.12-capd-manager Package: cri-tools Package: crictl Package: crossplane-2.2-crank Package: dagger Package: datadog-agent-7.72 Package: datadog-agent-7.72-full Package: datadog-agent-7.73 Package: datadog-agent-7.73-full Package: datadog-agent-7.77 Package: datadog-agent-7.77-full Package: datadog-agent-7.78 Package: datadog-agent-7.78-full Package: datadog-cluster-agent-7.72 Package: datadog-cluster-agent-7.73 Package: datadog-cluster-agent-7.77 Package: datadog-cluster-agent-7.78 Package: dive Package: docker Package: docker-credential-gcr Package: docker.io Package: docker.io Package: docker.io-app Package: dockerd-28 Package: dockerd-29 Package: dogstatsd-7.72 Package: dogstatsd-7.73 Package: dogstatsd-7.77 Package: dogstatsd-7.78 Package: envoy-gateway Package: envoy-gateway-egctl Package: falco-no-driver Package: falcoctl Package: gatekeeper-3.22-gator Package: github.com/docker/docker Package: github.com/moby/moby Package: github.com/moby/moby/v2 Package: gitlab-docker-machine-18.10 Package: gitlab-docker-machine-18.11 Package: gitlab-docker-machine-18.6 Package: gitlab-docker-machine-18.7 Package: gitlab-docker-machine-18.8 Package: gitlab-docker-machine-18.9 Package: gitlab-docker-machine-19.0 Package: gitlab-docker-machine-19.1 Package: gitlab-docker-machine-19.2 Package: gitlab-runner-18.10 Package: gitlab-runner-18.11 Package: gitlab-runner-18.6 Package: gitlab-runner-18.7 Package: gitlab-runner-18.8 Package: gitlab-runner-18.9 Package: gitlab-runner-19.0 Package: gitlab-runner-19.1 Package: gitlab-runner-helper-18.10 Package: gitlab-runner-helper-18.11 Package: gitlab-runner-helper-18.6 Package: gitlab-runner-helper-18.7 Package: gitlab-runner-helper-18.8 Package: gitlab-runner-helper-18.9 Package: gitlab-runner-helper-19.0 Package: gitlab-runner-helper-19.1 Package: gitness Package: goreleaser Package: grafana-12.3 Package: grafana-12.4 Package: grafana-13.0 Package: grafana-alloy Package: grype Package: hydra Package: k3s Package: k3s-1.32 Package: k3s-static Package: k3s-static-1.32 Package: k8sgpt Package: kaniko Package: kaniko-warmer Package: ko Package: kots Package: kpt Package: kubescape-operator Package: kubevela-vela-cli Package: kubevela-vela-core Package: lazydocker Package: loki-3.6-promtail Package: manifest-tool Package: melange Package: nerdctl Package: neuvector-scanner Package: neuvector-scanner-task Package: newrelic-infrastructure-agent Package: nuclei Package: openfga Package: opentelemetry-collector Package: opentelemetry-collector-contrib Package: opentelemetry-operator Package: opentelemetry-operator-otel-allocator Package: osv-scanner Package: podman Package: portieris Package: promxy Package: pulumi Package: rancher-2.13 Package: rancher-2.14 Package: rancher-agent-2.13 Package: rancher-agent-2.14 Package: rancher-machine Package: rpk-26.1.2 Package: rpk-26.1.7 Package: rpk-26.1.8 Package: scorecard Package: skaffold Package: skopeo Package: spire-agent Package: splunk-otel-collector Package: telegraf-1.38 Package: teleport-18.6 Package: tkn Package: traefik-3.6 Package: trivy Package: trivy-operator Package: trufflehog Package: tw Package: twt Package: undock Package: vcluster Package: vcluster-cli Package: vcluster-syncer Package: wolfictl Package: xeol Package: zarf Package: zot Ecosystem: Alpine Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.

Affected products

VendorProductAffectedFixed
moby moby < 29.3.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 docker.io 28.5.2+dfsg4-2 —
Debian 13 docker.io 26.1.5+dfsg1-9+deb13u1 —
Debian 12 docker.io No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 docker.io +1 No fix yet —
Ubuntu 26.04 LTS docker.io +1 No fix yet —
Ubuntu 25.10 docker.io +1 No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS docker.io +1 No fix yet —
Ubuntu Pro 22.04 LTS docker.io +1 No fix yet —
Ubuntu Pro 20.04 LTS docker.io +1 No fix yet —
Ubuntu Pro 18.04 LTS docker.io No fix yet —
Ubuntu Pro 16.04 LTS docker.io No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 docker-stable 24.0.9_ce-150000.1.45.1 SUSE-SU-2026:2579-1
SLES 15 SP6 docker-stable 24.0.9_ce-150000.1.45.1 SUSE-SU-2026:2579-1
SLES 15 SP5 docker-stable 24.0.9_ce-150000.1.45.1 SUSE-SU-2026:2579-1
SLES 15 SP4 docker-stable 24.0.9_ce-150000.1.45.1 SUSE-SU-2026:2579-1
SLES 12 SP5 docker-stable 24.0.9_ce-1.37.1 SUSE-SU-2026:2578-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 docker-stable 24.0.9_ce-150000.1.45.1 SUSE-SU-2026:2579-1
SLES for SAP 15 SP5 docker-stable 24.0.9_ce-150000.1.45.1 SUSE-SU-2026:2579-1
SLES for SAP 15 SP4 docker-stable 24.0.9_ce-150000.1.45.1 SUSE-SU-2026:2579-1
SLE HPC 15 SP5 docker-stable 24.0.9_ce-150000.1.45.1 SUSE-SU-2026:2579-1
SLE HPC 15 SP4 docker-stable 24.0.9_ce-150000.1.45.1 SUSE-SU-2026:2579-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed docker-stable 24.0.9_ce-18.1 openSUSE-SU-2026:11075-1
openSUSE Leap 16.0 docker-stable 24.0.9_ce-160000.6.1 openSUSE-SU-2026:21205-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20260402T184258-150000.1.158.1 SUSE-SU-2026:1205-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 docker 29.3.1-r0 —
Alpine v3.23 docker 29.3.1-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 docker 25.0.14-1.amzn2023.0.5 ALAS2023-2026-1659

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling amazon-cloudwatch-agent 1.300074.0-r0 —
Wolfi rolling amazon-cloudwatch-agent-operator 3.6.0-r0 —
Wolfi rolling apko 1.2.0-r0 —
Wolfi rolling aws-otel-collector 0.48.0-r0 —
Wolfi rolling buf 1.68.3-r0 —
Wolfi rolling buildah 1.44.0-r0 —
Wolfi rolling cluster-api-1.12-capd-manager 1.12.5-r0 —
Wolfi rolling crictl +1 1.37.0-r0 —
Wolfi rolling datadog-agent-7.77-full 7.77.3-r10 —
Wolfi rolling docker-credential-gcr 2.2.0-r0 —
Wolfi rolling dockerd-29 29.4.1-r0 —
Wolfi rolling envoy-gateway 1.8.0-r0 —
Wolfi rolling envoy-gateway-egctl 1.8.2-r0 —
Wolfi rolling gatekeeper-3.22-gator 3.22.1-r1 —
Wolfi rolling goreleaser 2.15.0-r0 —
Wolfi rolling grafana-12.3 12.3.7-r0 —
Wolfi rolling grafana-12.4 12.4.4-r0 —
Wolfi rolling grafana-13.0 13.0.2-r0 —
Wolfi rolling grafana-alloy 1.20.0-r0 —
Wolfi rolling grype 0.121.3-r0 —
Wolfi rolling k8sgpt 0.4.36-r1 —
Wolfi rolling ko 0.19.0-r0 —
Wolfi rolling kots 1.131.0-r0 —
Wolfi rolling kpt 1.0.0-r0 —
Wolfi rolling melange 0.48.2-r1 —
Wolfi rolling nerdctl 2.3.1-r0 —
Wolfi rolling neuvector-scanner +1 4.126-r0 —
Wolfi rolling newrelic-infrastructure-agent 1.73.1-r0 —
Wolfi rolling nuclei 3.9.0-r0 —
Wolfi rolling openfga 1.14.2-r0 —
Wolfi rolling opentelemetry-collector 0.150.0-r0 —
Wolfi rolling opentelemetry-operator 0.149.0-r0 —
Wolfi rolling opentelemetry-operator-otel-allocator 0.154.0-r0 —
Wolfi rolling osv-scanner 2.5.0-r0 —
Wolfi rolling podman 6.0.0-r0 —
Wolfi rolling portieris 0.14.1-r0 —
Wolfi rolling pulumi 3.241.0-r0 —
Wolfi rolling rancher-2.13 +1 2.13.7-r0 —
Wolfi rolling rancher-2.14 +1 2.14.3-r0 —
Wolfi rolling rancher-machine 0.15.0.144-r0 —
Wolfi rolling scorecard 5.6.0-r0 —
Wolfi rolling skopeo 1.23.0-r0 —
Wolfi rolling spire-agent 1.15.2-r0 —
Wolfi rolling splunk-otel-collector +1 0.151.0-r0 —
Wolfi rolling traefik-3.6 3.6.16-r1 —
Wolfi rolling trivy 0.70.0-r0 —
Wolfi rolling trivy-operator 0.30.1-r26 —
Wolfi rolling tw +74 No fix yet —
Wolfi rolling undock 0.14.0-r0 —
Wolfi rolling wolfictl 0.39.6-r2 —
Wolfi rolling zarf 0.74.1-r0 —
Wolfi rolling zot 2.1.17-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/docker/docker all versions — GHSA-pxq6-2prw-chj9
Go github.com/moby/moby all versions — GHSA-pxq6-2prw-chj9
Go github.com/moby/moby/v2 < 2.0.0-beta.8 2.0.0-beta.8 GHSA-pxq6-2prw-chj9

Advisories 8

References