Log in Start free

Vulnerability · Published Jun 12, 2026 · Assigned by GitHub_M

CVE-2026-41568Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap

Medium 6.1

In plain English

A medium-severity security flaw in moby from moby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.1%top 98.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23docker29.5.1-r0ALPINE-CVE-2026-41568
Alpine:v3.24docker29.5.1-r0ALPINE-CVE-2026-41568
Debian:12docker.iono fix listedDEBIAN-CVE-2026-41568
Debian:13docker.io26.1.5+dfsg1-9+deb13u1DEBIAN-CVE-2026-41568
Debian:14docker.io28.5.2+dfsg4-3DEBIAN-CVE-2026-41568
Gogithub.com/docker/dockerno fix listedGO-2026-5668
Gogithub.com/docker/dockerno fix listedGHSA-vp62-88p7-qqf5
Gogithub.com/moby/mobyno fix listedGO-2026-5668
Gogithub.com/moby/mobyno fix listedGHSA-vp62-88p7-qqf5
Gogithub.com/moby/moby/v22.0.0-beta.14GHSA-vp62-88p7-qqf5
Gogithub.com/moby/moby/v22.0.0-beta.14GO-2026-5668
Ubuntu:25.10docker.iono fix listedUBUNTU-CVE-2026-41568
Ubuntu:26.04:LTSdocker.iono fix listedUBUNTU-CVE-2026-41568
Ubuntu:26.10docker.iono fix listedUBUNTU-CVE-2026-41568
Ubuntu:25.10docker.io-appno fix listedUBUNTU-CVE-2026-41568
Ubuntu:26.04:LTSdocker.io-appno fix listedUBUNTU-CVE-2026-41568
Ubuntu:26.10docker.io-appno fix listedUBUNTU-CVE-2026-41568

Affected products (as reported)

VendorProductVersions
moby moby github.com/docker/docker/daemon <= 28.5.2Docker Engine < 29.5.1github.com/moby/moby/v2/daemon < 2.0.0-beta.14

Weakness: CWE-81, CWE-367 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:H

References