CVE-2025-54388
MediumCVSS 4.6Summary
In Docker Engine versions 28.2.0 through 28.3.2, reloading the firewalld service removes all iptables rules including those created by Docker. Versions before 28.3.3 fail to recreate the rules blocking external access to containers, so containers with ports published to localhost become accessible from remote machines with routing to the Docker bridge. This is fixed in version 28.3.3.
Risk Assessment
After a firewalld reload, containers that should only be locally accessible may be exposed to network access, leading to unauthorized access to services. The risk affects Docker environments using firewalld with published ports.
Recommendation
Update Docker Engine to version 28.3.3 or later. Until patched, avoid reloading firewalld or verify iptables rules after each reload.
Other vulnerabilities in Docker Engine
See all- CVE-2016-8867High
Docker Engine version 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.
- CVE-2015-3630High
Docker Engine before version 1.6.1 uses weak permissions for several system directories, allowing local users to modify the host and obtain sensitive information.
- CVE-2026-92543High
Vulnerability in Docker Engine regarding incorrect classification of a registry as insecure. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default, and isCIDRMatch returns true if any host address matches. An attacker can use a DNS answer with a loopback IP and an attacker IP to disable certificate verification and enable HTTP fallback.
Original NVD description (English source)
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS