CVE-2026-33997
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Moby (Docker) before version 29.3.1 has a vulnerability that allows bypassing plugin privilege validation during installation. The daemon may accept a privilege set different from the user-approved one, and for single-privilege plugins no comparison is performed.
Risk Assessment
Attackers could install a plugin with excessive privileges, potentially leading to privilege escalation and container security breaches.
Recommendation
Update Moby/Docker to version 29.3.1 or later, which includes a fix for the privilege comparison logic.
Other vulnerabilities in Moby
See all- CVE-2026-34040High
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.
- CVE-2026-41567High
Moby (Docker Engine) before versions 29.5.1 and v2.0.0-beta.14 has a vulnerability where the daemon uses decompression binaries from the container's filesystem when extracting archives. A malicious image can replace these binaries, leading to arbitrary code execution with full daemon privileges.
Original NVD description (English source)
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.