Log in Start free

Vulnerability · Published Jun 5, 2026 · Assigned by GitHub_M

CVE-2026-41567Docker: `PUT /containers/{id}/archive` executes container binary on the host

High 7.2

In plain English

A high-severity uncontrolled search path in docker/daemon from docker. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.2%top 95.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23docker29.5.1-r0ALPINE-CVE-2026-41567
Alpine:v3.24docker29.5.1-r0ALPINE-CVE-2026-41567
Debian:12docker.iono fix listedDEBIAN-CVE-2026-41567
Debian:13docker.io26.1.5+dfsg1-9+deb13u1DEBIAN-CVE-2026-41567
Debian:14docker.io28.5.2+dfsg4-3DEBIAN-CVE-2026-41567
Gogithub.com/docker/dockerno fix listedGHSA-x86f-5xw2-fm2r
Gogithub.com/docker/dockerno fix listedGO-2026-5746
Gogithub.com/moby/mobyno fix listedGHSA-x86f-5xw2-fm2r
Gogithub.com/moby/mobyno fix listedGO-2026-5746
Gogithub.com/moby/moby/v22.0.0-beta.14GO-2026-5746
Gogithub.com/moby/moby/v22.0.0-beta.14GHSA-x86f-5xw2-fm2r
Ubuntu:25.10docker.iono fix listedUBUNTU-CVE-2026-41567
Ubuntu:26.04:LTSdocker.iono fix listedUBUNTU-CVE-2026-41567
Ubuntu:26.10docker.iono fix listedUBUNTU-CVE-2026-41567
Ubuntu:25.10docker.io-appno fix listedUBUNTU-CVE-2026-41567
Ubuntu:26.04:LTSdocker.io-appno fix listedUBUNTU-CVE-2026-41567
Ubuntu:26.10docker.io-appno fix listedUBUNTU-CVE-2026-41567

Affected products (as reported)

VendorProductVersions
moby moby/v2/daemon < 2.0.0-beta.14
moby Docker Engine < 29.5.1
docker docker/daemon <= 28.5.2

Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

References