Skip to content
OpenAdvisories
High · 8.8 Public exploit CVE-2026-34040 EUVD-2026-17289GHSA-x744-4wpc-v9h2GO-2026-4887

Moby: AuthZ plugin bypass with oversized request body

Published Mar 31, 2026 · Updated Apr 2, 2026 · Assigned by GitHub_M

Vendor: moby Product: moby Package: amazon-cloudwatch-agent Package: amazon-cloudwatch-agent-operator Package: apko Package: aws-otel-collector Package: buf Package: buildah Package: cluster-api-1.12-capd-manager Package: cri-tools Package: crictl Package: crossplane-2.2-crank Package: datadog-agent-7.72 Package: datadog-agent-7.72-full Package: datadog-agent-7.73 Package: datadog-agent-7.73-full Package: datadog-agent-7.77 Package: datadog-agent-7.77-full Package: datadog-agent-7.78 Package: datadog-agent-7.78-full Package: datadog-cluster-agent-7.72 Package: datadog-cluster-agent-7.73 Package: datadog-cluster-agent-7.77 Package: datadog-cluster-agent-7.78 Package: dive Package: docker Package: docker-credential-gcr Package: docker.io Package: docker.io Package: docker.io-app Package: dockerd-28 Package: dockerd-29 Package: dogstatsd-7.72 Package: dogstatsd-7.73 Package: dogstatsd-7.77 Package: dogstatsd-7.78 Package: envoy-gateway Package: envoy-gateway-egctl Package: falco-no-driver Package: falcoctl Package: gatekeeper-3.22-gator Package: github.com/docker/docker Package: github.com/moby/moby Package: github.com/moby/moby/v2 Package: gitlab-docker-machine-18.10 Package: gitlab-docker-machine-18.11 Package: gitlab-docker-machine-18.6 Package: gitlab-docker-machine-18.7 Package: gitlab-docker-machine-18.8 Package: gitlab-docker-machine-18.9 Package: gitlab-docker-machine-19.0 Package: gitlab-docker-machine-19.1 Package: gitlab-docker-machine-19.2 Package: gitlab-runner-18.10 Package: gitlab-runner-18.11 Package: gitlab-runner-18.6 Package: gitlab-runner-18.7 Package: gitlab-runner-18.8 Package: gitlab-runner-18.9 Package: gitlab-runner-19.0 Package: gitlab-runner-19.1 Package: gitlab-runner-helper-18.10 Package: gitlab-runner-helper-18.11 Package: gitlab-runner-helper-18.6 Package: gitlab-runner-helper-18.7 Package: gitlab-runner-helper-18.8 Package: gitlab-runner-helper-18.9 Package: gitlab-runner-helper-19.0 Package: gitlab-runner-helper-19.1 Package: gitness Package: goreleaser Package: grafana-12.3 Package: grafana-12.4 Package: grafana-13.0 Package: grafana-alloy Package: grype Package: hydra Package: k3s Package: k3s-1.32 Package: k3s-static Package: k3s-static-1.32 Package: k8sgpt Package: kaniko Package: kaniko-warmer Package: ko Package: kots Package: kpt Package: kubescape-operator Package: kubevela-vela-cli Package: kubevela-vela-core Package: lazydocker Package: loki-3.6-promtail Package: manifest-tool Package: melange Package: nerdctl Package: neuvector-scanner Package: neuvector-scanner-task Package: newrelic-infrastructure-agent Package: nuclei Package: openfga Package: opentelemetry-collector Package: opentelemetry-collector-contrib Package: opentelemetry-operator Package: opentelemetry-operator-otel-allocator Package: osv-scanner Package: podman Package: portieris Package: promxy Package: pulumi Package: rancher-2.13 Package: rancher-2.14 Package: rancher-agent-2.13 Package: rancher-agent-2.14 Package: rancher-machine Package: rpk-26.1.2 Package: rpk-26.1.7 Package: rpk-26.1.8 Package: skaffold Package: skopeo Package: spire-agent Package: splunk-otel-collector Package: telegraf-1.38 Package: teleport-18.6 Package: tkn Package: traefik-3.6 Package: trivy Package: trivy-operator Package: trufflehog Package: undock Package: vcluster Package: vcluster-cli Package: vcluster-syncer Package: wolfictl Package: xeol Package: zarf Package: zot Ecosystem: Alpine Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

Affected products

VendorProductAffectedFixed
moby moby < 29.3.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 docker.io 28.5.2+dfsg4-2 —
Debian 13 docker.io 26.1.5+dfsg1-9+deb13u1 —
Debian 12 docker.io No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 docker.io +1 No fix yet —
Ubuntu 26.04 LTS docker.io +1 No fix yet —
Ubuntu 25.10 docker.io +1 No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS docker.io +1 No fix yet —
Ubuntu Pro 22.04 LTS docker.io +1 No fix yet —
Ubuntu Pro 20.04 LTS docker.io +1 No fix yet —
Ubuntu Pro 18.04 LTS docker.io No fix yet —
Ubuntu Pro 16.04 LTS docker.io No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 docker-stable 24.0.9_ce-150000.1.45.1 SUSE-SU-2026:2579-1
SLES 15 SP6 docker-stable 24.0.9_ce-150000.1.45.1 SUSE-SU-2026:2579-1
SLES 15 SP5 docker-stable 24.0.9_ce-150000.1.45.1 SUSE-SU-2026:2579-1
SLES 15 SP4 docker-stable 24.0.9_ce-150000.1.45.1 SUSE-SU-2026:2579-1
SLES 12 SP5 docker-stable 24.0.9_ce-1.37.1 SUSE-SU-2026:2578-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 docker-stable 24.0.9_ce-150000.1.45.1 SUSE-SU-2026:2579-1
SLES for SAP 15 SP5 docker-stable 24.0.9_ce-150000.1.45.1 SUSE-SU-2026:2579-1
SLES for SAP 15 SP4 docker-stable 24.0.9_ce-150000.1.45.1 SUSE-SU-2026:2579-1
SLE HPC 15 SP5 docker-stable 24.0.9_ce-150000.1.45.1 SUSE-SU-2026:2579-1
SLE HPC 15 SP4 docker-stable 24.0.9_ce-150000.1.45.1 SUSE-SU-2026:2579-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed docker-stable 24.0.9_ce-18.1 openSUSE-SU-2026:11075-1
openSUSE Leap 16.0 docker-stable 24.0.9_ce-160000.6.1 openSUSE-SU-2026:21205-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20260402T184258-150000.1.158.1 SUSE-SU-2026:1205-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 docker 29.3.1-r0 —
Alpine v3.23 docker 29.3.1-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 docker 25.0.14-1.amzn2023.0.4 ALAS2023-2026-1615

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling amazon-cloudwatch-agent 1.300074.0-r0 —
Wolfi rolling amazon-cloudwatch-agent-operator 3.6.0-r0 —
Wolfi rolling apko 1.2.0-r0 —
Wolfi rolling aws-otel-collector 0.48.0-r0 —
Wolfi rolling buf 1.68.3-r0 —
Wolfi rolling buildah 1.44.0-r0 —
Wolfi rolling cluster-api-1.12-capd-manager 1.12.5-r0 —
Wolfi rolling crictl +1 1.37.0-r0 —
Wolfi rolling datadog-agent-7.77-full 7.77.3-r10 —
Wolfi rolling docker-credential-gcr 2.2.0-r0 —
Wolfi rolling dockerd-29 29.4.1-r0 —
Wolfi rolling envoy-gateway 1.8.0-r0 —
Wolfi rolling envoy-gateway-egctl 1.8.2-r0 —
Wolfi rolling gatekeeper-3.22-gator 3.22.1-r1 —
Wolfi rolling goreleaser 2.15.0-r0 —
Wolfi rolling grafana-12.3 12.3.7-r0 —
Wolfi rolling grafana-12.4 12.4.4-r0 —
Wolfi rolling grafana-13.0 13.0.2-r0 —
Wolfi rolling grafana-alloy 1.20.0-r0 —
Wolfi rolling grype 0.121.3-r0 —
Wolfi rolling k3s +71 No fix yet —
Wolfi rolling k8sgpt 0.4.36-r1 —
Wolfi rolling ko 0.19.0-r0 —
Wolfi rolling kots 1.131.0-r0 —
Wolfi rolling kpt 1.0.0-r0 —
Wolfi rolling melange 0.46.1-r1 —
Wolfi rolling nerdctl 2.3.1-r0 —
Wolfi rolling neuvector-scanner +1 4.126-r0 —
Wolfi rolling newrelic-infrastructure-agent 1.73.1-r0 —
Wolfi rolling nuclei 3.9.0-r0 —
Wolfi rolling openfga 1.14.2-r0 —
Wolfi rolling opentelemetry-collector 0.150.0-r0 —
Wolfi rolling opentelemetry-operator 0.149.0-r0 —
Wolfi rolling opentelemetry-operator-otel-allocator 0.154.0-r0 —
Wolfi rolling osv-scanner 2.5.0-r0 —
Wolfi rolling podman 6.0.0-r0 —
Wolfi rolling portieris 0.14.1-r0 —
Wolfi rolling pulumi 3.241.0-r0 —
Wolfi rolling rancher-2.13 +1 2.13.7-r0 —
Wolfi rolling rancher-2.14 +1 2.14.3-r0 —
Wolfi rolling rancher-machine 0.15.0.144-r0 —
Wolfi rolling skopeo 1.23.0-r0 —
Wolfi rolling spire-agent 1.15.2-r0 —
Wolfi rolling splunk-otel-collector +1 0.151.0-r0 —
Wolfi rolling traefik-3.6 3.6.16-r1 —
Wolfi rolling trivy 0.70.0-r0 —
Wolfi rolling trivy-operator 0.30.1-r26 —
Wolfi rolling undock 0.14.0-r0 —
Wolfi rolling wolfictl 0.39.6-r2 —
Wolfi rolling zarf 0.74.1-r0 —
Wolfi rolling zot 2.1.17-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/docker/docker all versions — GO-2026-4887
Go github.com/moby/moby < 29.3.1 29.3.1 GHSA-x744-4wpc-v9h2
Go github.com/moby/moby all versions — GO-2026-4887
Go github.com/moby/moby/v2 < 2.0.0-beta.8 2.0.0-beta.8 GHSA-x744-4wpc-v9h2

Advisories 8

References