CVE-2026-92543
HighCVSS 7.6Summary
Vulnerability in Docker Engine regarding incorrect classification of a registry as insecure. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default, and isCIDRMatch returns true if any host address matches. An attacker can use a DNS answer with a loopback IP and an attacker IP to disable certificate verification and enable HTTP fallback.
Risk Assessment
An attacker can intercept registry traffic, impersonate the registry, and inject malicious container images, potentially leading to container environment integrity compromise and malicious code execution in the organization.
Recommendation
Update Docker Engine to a patched version. Additionally, configure registries as secure (HTTPS) and avoid using insecure registries in production environments.
Other vulnerabilities in Docker Engine
See all- CVE-2016-8867High
Docker Engine version 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.
- CVE-2015-3630High
Docker Engine before version 1.6.1 uses weak permissions for several system directories, allowing local users to modify the host and obtain sensitive information.
Original NVD description (English source)
Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Because the transport re-dials the hostname rather than the CIDR-matching address, a DNS answer set of one loopback IP plus a non-loopback attacker IP disables certificate verification and enables HTTP fallback for the registry connection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS