Skip to content
OpenAdvisories
High · 7.2 CVE-2026-42306 EUVD-2026-36528GHSA-rg2x-37c3-w2rhGO-2026-5617

Moby: Race condition in docker cp allows bind mount redirection to host path

Published Jun 12, 2026 · Updated Jun 13, 2026 · Assigned by GitHub_M

Vendor: moby Product: moby Package: amazon-cloudwatch-agent Package: amazon-cloudwatch-agent-operator Package: aws-otel-collector Package: buildah Package: cri-tools Package: crictl Package: datadog-agent-7.73 Package: datadog-agent-7.73-full Package: datadog-agent-7.77 Package: datadog-agent-7.77-full Package: datadog-agent-7.78 Package: datadog-agent-7.78-full Package: datadog-cluster-agent-7.77 Package: datadog-cluster-agent-7.78 Package: dive Package: docker-28 Package: docker-credential-gcr Package: docker.io Package: docker.io Package: docker.io-app Package: dockerd-28 Package: dogstatsd-7.72 Package: dogstatsd-7.73 Package: dogstatsd-7.77 Package: dogstatsd-7.78 Package: envoy-gateway-egctl Package: falco-no-driver Package: falcoctl Package: github.com/docker/docker Package: github.com/moby/moby Package: github.com/moby/moby/v2 Package: gitlab-docker-machine-18.10 Package: gitlab-docker-machine-18.11 Package: gitlab-docker-machine-18.6 Package: gitlab-docker-machine-18.7 Package: gitlab-docker-machine-18.8 Package: gitlab-docker-machine-18.9 Package: gitlab-docker-machine-19.0 Package: gitlab-docker-machine-19.1 Package: gitlab-runner-18.10 Package: gitlab-runner-18.11 Package: gitlab-runner-18.6 Package: gitlab-runner-18.7 Package: gitlab-runner-18.8 Package: gitlab-runner-18.9 Package: gitlab-runner-19.0 Package: gitlab-runner-19.1 Package: gitlab-runner-helper-18.10 Package: gitlab-runner-helper-18.11 Package: gitlab-runner-helper-18.6 Package: gitlab-runner-helper-18.7 Package: gitlab-runner-helper-18.8 Package: gitlab-runner-helper-18.9 Package: gitlab-runner-helper-19.0 Package: gitlab-runner-helper-19.1 Package: gitness Package: grafana-12.3 Package: grafana-12.4 Package: grafana-13.0 Package: grafana-alloy Package: grype Package: hydra Package: k3s Package: k3s-1.32 Package: k3s-static Package: k3s-static-1.32 Package: k8sgpt Package: kaniko Package: kaniko-warmer Package: ko Package: kots Package: kpt Package: kubescape-operator Package: kubevela-vela-cli Package: kubevela-vela-core Package: lazydocker Package: loki-3.6-promtail Package: melange Package: nerdctl Package: nuclei Package: opentelemetry-operator-otel-allocator Package: podman Package: portieris Package: prometheus-3.9 Package: promxy Package: rancher-2.13 Package: rancher-2.14 Package: rancher-agent-2.13 Package: rancher-agent-2.14 Package: rancher-machine Package: rpk-26.1.8 Package: skaffold Package: skopeo Package: spire-agent Package: telegraf-1.38 Package: tkn Package: trivy Package: trivy-operator Package: trufflehog Package: undock Package: vcluster Package: vcluster-cli Package: vcluster-syncer Package: xeol Package: zot Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.

Affected products

VendorProductAffectedFixed
moby moby github.com/docker/docker/daemon <= 28.5.2, Docker Engine < 29.5.1, github.com/moby/moby/v2/daemon < 2.0.0-beta.14 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 docker.io 28.5.2+dfsg4-3 —
Debian 13 docker.io 26.1.5+dfsg1-9+deb13u1 —
Debian 12 docker.io No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 docker.io +1 No fix yet —
Ubuntu 26.04 LTS docker.io +1 No fix yet —
Ubuntu 25.10 docker.io +1 No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS docker.io +1 No fix yet —
Ubuntu Pro 22.04 LTS docker.io +1 No fix yet —
Ubuntu Pro 20.04 LTS docker.io +1 No fix yet —
Ubuntu Pro 18.04 LTS docker.io No fix yet —
Ubuntu Pro 16.04 LTS docker.io No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Edge Manager 1 flightctl +2 1.1.4-1.el9em RHSA-2026:68334

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 govulncheck-vulndb 0.0.20260727T201416-160000.1.1 SUSE-SU-2026:23227-1, SUSE-SU-2026:23216-1
SLES 16.0 govulncheck-vulndb 0.0.20260727T201416-160000.1.1 SUSE-SU-2026:23227-1, SUSE-SU-2026:23216-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21551-1, openSUSE-SU-2026:21483-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 docker 25.0.16-1.amzn2023.0.1 ALAS2023-2026-1783

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling amazon-cloudwatch-agent 1.300074.0-r0 —
Wolfi rolling amazon-cloudwatch-agent-operator 3.6.0-r0 —
Wolfi rolling aws-otel-collector 0.48.0-r0 —
Wolfi rolling buildah 1.44.0-r0 —
Wolfi rolling crictl +1 1.37.0-r0 —
Wolfi rolling datadog-agent-7.77-full 7.77.3-r10 —
Wolfi rolling docker-credential-gcr 2.2.0-r0 —
Wolfi rolling envoy-gateway-egctl 1.8.2-r0 —
Wolfi rolling grafana-12.3 12.3.7-r0 —
Wolfi rolling grafana-12.4 12.4.4-r0 —
Wolfi rolling grafana-13.0 13.0.2-r0 —
Wolfi rolling grafana-alloy 1.20.0-r0 —
Wolfi rolling grype 0.121.3-r0 —
Wolfi rolling k3s +64 No fix yet —
Wolfi rolling k8sgpt 0.4.36-r1 —
Wolfi rolling ko 0.19.0-r0 —
Wolfi rolling kots 1.131.0-r0 —
Wolfi rolling kpt 1.0.0-r0 —
Wolfi rolling nerdctl 2.3.1-r0 —
Wolfi rolling nuclei 3.9.0-r0 —
Wolfi rolling opentelemetry-operator-otel-allocator 0.154.0-r0 —
Wolfi rolling podman 6.0.0-r0 —
Wolfi rolling portieris 0.14.1-r0 —
Wolfi rolling rancher-2.13 +1 2.13.7-r0 —
Wolfi rolling rancher-2.14 +1 2.14.3-r0 —
Wolfi rolling rancher-machine 0.15.0.144-r0 —
Wolfi rolling skopeo 1.23.0-r0 —
Wolfi rolling spire-agent 1.15.2-r0 —
Wolfi rolling trivy 0.70.0-r0 —
Wolfi rolling trivy-operator 0.30.1-r26 —
Wolfi rolling undock 0.14.0-r0 —
Wolfi rolling zot 2.1.17-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/docker/docker <= 28.5.2 — GHSA-rg2x-37c3-w2rh
Go github.com/docker/docker all versions — GO-2026-5617
Go github.com/moby/moby <= 28.5.2 — GHSA-rg2x-37c3-w2rh
Go github.com/moby/moby all versions — GO-2026-5617
Go github.com/moby/moby/v2 < 2.0.0-beta.14 2.0.0-beta.14 GHSA-rg2x-37c3-w2rh

Advisories 7

References