CVE-2026-34040
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk94th percentile - higher than 94% of all known CVEs
Summary
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.
Risk Assessment
Organizations may be exposed to unauthorized access to resources, potentially leading to serious security breaches.
Recommendation
It is recommended to upgrade to version 29.3.1 or later to mitigate this vulnerability.
Other vulnerabilities in Moby
See all- CVE-2026-41567High
Moby (Docker Engine) before versions 29.5.1 and v2.0.0-beta.14 has a vulnerability where the daemon uses decompression binaries from the container's filesystem when extracting archives. A malicious image can replace these binaries, leading to arbitrary code execution with full daemon privileges.
- CVE-2026-33997Medium
Moby (Docker) before version 29.3.1 has a vulnerability that allows bypassing plugin privilege validation during installation. The daemon may accept a privilege set different from the user-approved one, and for single-privilege plugins no comparison is performed.
Original NVD description (English source)
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.