Skip to content
OpenAdvisories
Medium · 6.1 CVE-2026-41568 EUVD-2026-36527GHSA-vp62-88p7-qqf5GO-2026-5668

Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap

Published Jun 12, 2026 · Updated Jun 12, 2026 · Assigned by GitHub_M

Vendor: moby Product: moby Package: amazon-cloudwatch-agent Package: amazon-cloudwatch-agent-operator Package: aws-otel-collector Package: buildah Package: cri-tools Package: crictl Package: datadog-agent-7.73 Package: datadog-agent-7.73-full Package: datadog-agent-7.77 Package: datadog-agent-7.77-full Package: datadog-agent-7.78 Package: datadog-agent-7.78-full Package: datadog-cluster-agent-7.77 Package: datadog-cluster-agent-7.78 Package: dive Package: docker Package: docker-28 Package: docker-credential-gcr Package: docker.io Package: docker.io Package: docker.io-app Package: dockerd-28 Package: dogstatsd-7.72 Package: dogstatsd-7.73 Package: dogstatsd-7.77 Package: dogstatsd-7.78 Package: envoy-gateway-egctl Package: falco-no-driver Package: falcoctl Package: github.com/docker/docker Package: github.com/moby/moby Package: github.com/moby/moby/v2 Package: gitlab-docker-machine-18.10 Package: gitlab-docker-machine-18.11 Package: gitlab-docker-machine-18.6 Package: gitlab-docker-machine-18.7 Package: gitlab-docker-machine-18.8 Package: gitlab-docker-machine-18.9 Package: gitlab-docker-machine-19.0 Package: gitlab-docker-machine-19.1 Package: gitlab-runner-18.10 Package: gitlab-runner-18.11 Package: gitlab-runner-18.6 Package: gitlab-runner-18.7 Package: gitlab-runner-18.8 Package: gitlab-runner-18.9 Package: gitlab-runner-19.0 Package: gitlab-runner-19.1 Package: gitlab-runner-helper-18.10 Package: gitlab-runner-helper-18.11 Package: gitlab-runner-helper-18.6 Package: gitlab-runner-helper-18.7 Package: gitlab-runner-helper-18.8 Package: gitlab-runner-helper-18.9 Package: gitlab-runner-helper-19.0 Package: gitlab-runner-helper-19.1 Package: gitness Package: grafana-12.3 Package: grafana-12.4 Package: grafana-13.0 Package: grafana-alloy Package: grype Package: hydra Package: k3s Package: k3s-1.32 Package: k3s-static Package: k3s-static-1.32 Package: k8sgpt Package: kaniko Package: kaniko-warmer Package: ko Package: kots Package: kpt Package: kubescape-operator Package: kubevela-vela-cli Package: kubevela-vela-core Package: lazydocker Package: loki-3.6-promtail Package: melange Package: nerdctl Package: nuclei Package: opentelemetry-operator-otel-allocator Package: osv-scanner Package: podman Package: portieris Package: prometheus-3.9 Package: promxy Package: rancher-2.13 Package: rancher-2.14 Package: rancher-agent-2.13 Package: rancher-agent-2.14 Package: rancher-machine Package: rpk-26.1.8 Package: skaffold Package: skopeo Package: spire-agent Package: telegraf-1.38 Package: teleport-18.6 Package: tkn Package: trivy Package: trivy-operator Package: trufflehog Package: undock Package: vcluster Package: vcluster-cli Package: vcluster-syncer Package: xeol Package: zot Ecosystem: Alpine Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.

Affected products

VendorProductAffectedFixed
moby moby github.com/docker/docker/daemon <= 28.5.2, Docker Engine < 29.5.1, github.com/moby/moby/v2/daemon < 2.0.0-beta.14 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 docker.io 28.5.2+dfsg4-3 —
Debian 13 docker.io 26.1.5+dfsg1-9+deb13u1 —
Debian 12 docker.io No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 docker.io +1 No fix yet —
Ubuntu 26.04 LTS docker.io +1 No fix yet —
Ubuntu 25.10 docker.io +1 No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS docker.io +1 No fix yet —
Ubuntu Pro 22.04 LTS docker.io +1 No fix yet —
Ubuntu Pro 20.04 LTS docker.io +1 No fix yet —
Ubuntu Pro 18.04 LTS docker.io No fix yet —
Ubuntu Pro 16.04 LTS docker.io No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 govulncheck-vulndb 0.0.20260827T195228-160000.1.1 SUSE-SU-2026:23625-1
SLES 16.0 govulncheck-vulndb 0.0.20260827T195228-160000.1.1 SUSE-SU-2026:23625-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21761-1, openSUSE-SU-2026:21483-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 docker 29.5.1-r0 —
Alpine v3.23 docker 29.5.1-r0 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling amazon-cloudwatch-agent 1.300074.0-r0 —
Wolfi rolling amazon-cloudwatch-agent-operator 3.6.0-r0 —
Wolfi rolling aws-otel-collector 0.48.0-r0 —
Wolfi rolling buildah 1.44.0-r0 —
Wolfi rolling crictl +1 1.37.0-r0 —
Wolfi rolling datadog-agent-7.77-full 7.77.3-r10 —
Wolfi rolling docker-credential-gcr 2.2.0-r0 —
Wolfi rolling envoy-gateway-egctl 1.8.2-r0 —
Wolfi rolling grafana-12.3 12.3.7-r0 —
Wolfi rolling grafana-12.4 12.4.4-r0 —
Wolfi rolling grafana-13.0 13.0.2-r0 —
Wolfi rolling grafana-alloy 1.20.0-r0 —
Wolfi rolling grype 0.121.3-r0 —
Wolfi rolling k3s +65 No fix yet —
Wolfi rolling k8sgpt 0.4.36-r1 —
Wolfi rolling ko 0.19.0-r0 —
Wolfi rolling kots 1.131.0-r0 —
Wolfi rolling kpt 1.0.0-r0 —
Wolfi rolling nerdctl 2.3.1-r0 —
Wolfi rolling nuclei 3.9.0-r0 —
Wolfi rolling opentelemetry-operator-otel-allocator 0.154.0-r0 —
Wolfi rolling osv-scanner 2.5.0-r0 —
Wolfi rolling podman 6.0.0-r0 —
Wolfi rolling portieris 0.14.1-r0 —
Wolfi rolling rancher-2.13 +1 2.13.7-r0 —
Wolfi rolling rancher-2.14 +1 2.14.3-r0 —
Wolfi rolling rancher-machine 0.15.0.144-r0 —
Wolfi rolling skopeo 1.23.0-r0 —
Wolfi rolling spire-agent 1.15.2-r0 —
Wolfi rolling trivy 0.70.0-r0 —
Wolfi rolling trivy-operator 0.30.1-r26 —
Wolfi rolling undock 0.14.0-r0 —
Wolfi rolling zot 2.1.17-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/docker/docker <= 28.5.2 — GHSA-vp62-88p7-qqf5
Go github.com/docker/docker all versions — GO-2026-5668
Go github.com/moby/moby <= 28.5.2 — GHSA-vp62-88p7-qqf5
Go github.com/moby/moby all versions — GO-2026-5668
Go github.com/moby/moby/v2 < 2.0.0-beta.14 2.0.0-beta.14 GHSA-vp62-88p7-qqf5

Advisories 4

References