Log in Start free

Vulnerability · Published Mar 31, 2026 · Assigned by GitHub_M

CVE-2026-34040Moby: AuthZ plugin bypass with oversized request body

High 8.8

In plain English

A high-severity authentication bypass in moby from moby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 9.3% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)9.3%top 4.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23docker29.3.1-r0ALPINE-CVE-2026-34040
Alpine:v3.24docker29.3.1-r0ALPINE-CVE-2026-34040
Debian:12docker.iono fix listedDEBIAN-CVE-2026-34040
Debian:13docker.io26.1.5+dfsg1-9+deb13u1DEBIAN-CVE-2026-34040
Debian:14docker.io28.5.2+dfsg4-2DEBIAN-CVE-2026-34040
Gogithub.com/docker/dockerno fix listedGO-2026-4887
Gogithub.com/moby/mobyno fix listedGO-2026-4887
Gogithub.com/moby/moby29.3.1GHSA-x744-4wpc-v9h2
Gogithub.com/moby/moby/v22.0.0-beta.8GO-2026-4887
Gogithub.com/moby/moby/v22.0.0-beta.8GHSA-x744-4wpc-v9h2
Ubuntu:25.10docker.iono fix listedUBUNTU-CVE-2026-34040
Ubuntu:26.04:LTSdocker.iono fix listedUBUNTU-CVE-2026-34040
Ubuntu:26.10docker.iono fix listedUBUNTU-CVE-2026-34040
Ubuntu:25.10docker.io-appno fix listedUBUNTU-CVE-2026-34040
Ubuntu:26.04:LTSdocker.io-appno fix listedUBUNTU-CVE-2026-34040
Ubuntu:26.10docker.io-appno fix listedUBUNTU-CVE-2026-34040

Affected products (as reported)

VendorProductVersions
moby moby < 29.3.1

Weakness: CWE-288 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References