Vulnerability · Published Mar 31, 2026 · Assigned by GitHub_M
CVE-2026-33997Moby: Off-by-one error in plugin privilege validation
Medium 6.8
In plain English
A medium-severity security flaw in moby from moby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | docker | 29.3.1-r0 | ALPINE-CVE-2026-33997 |
| Alpine:v3.24 | docker | 29.3.1-r0 | ALPINE-CVE-2026-33997 |
| Debian:12 | docker.io | no fix listed | DEBIAN-CVE-2026-33997 |
| Debian:13 | docker.io | 26.1.5+dfsg1-9+deb13u1 | DEBIAN-CVE-2026-33997 |
| Debian:14 | docker.io | 28.5.2+dfsg4-2 | DEBIAN-CVE-2026-33997 |
| Go | github.com/docker/docker | no fix listed | GO-2026-4883 |
| Go | github.com/docker/docker | no fix listed | GHSA-pxq6-2prw-chj9 |
| Go | github.com/moby/moby | no fix listed | GO-2026-4883 |
| Go | github.com/moby/moby | no fix listed | GHSA-pxq6-2prw-chj9 |
| Go | github.com/moby/moby/v2 | 2.0.0-beta.8 | GHSA-pxq6-2prw-chj9 |
| Go | github.com/moby/moby/v2 | 2.0.0-beta.8 | GO-2026-4883 |
| Ubuntu:25.10 | docker.io | no fix listed | UBUNTU-CVE-2026-33997 |
| Ubuntu:26.04:LTS | docker.io | no fix listed | UBUNTU-CVE-2026-33997 |
| Ubuntu:26.10 | docker.io | no fix listed | UBUNTU-CVE-2026-33997 |
| Ubuntu:25.10 | docker.io-app | no fix listed | UBUNTU-CVE-2026-33997 |
| Ubuntu:26.04:LTS | docker.io-app | no fix listed | UBUNTU-CVE-2026-33997 |
| Ubuntu:26.10 | docker.io-app | no fix listed | UBUNTU-CVE-2026-33997 |
Affected products (as reported)
Weakness: CWE-193, CWE-266 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
References
- https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9 x_refsource_CONFIRM
- https://github.com/moby/moby/releases/tag/docker-v29.3.1 x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-33997 vdb-entry, x_refsource_REDHAT
- RHBZ#2453277 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33997.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:22347 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:23345 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21769 vendor-advisory, x_refsource_REDHAT