Log in Start free

Vulnerability · Published Jun 12, 2026 · Assigned by GitHub_M

CVE-2026-42306Moby: Race condition in docker cp allows bind mount redirection to host path

High 7.2

In plain English

A high-severity security flaw in moby from moby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.1%top 99.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12docker.iono fix listedDEBIAN-CVE-2026-42306
Debian:13docker.io26.1.5+dfsg1-9+deb13u1DEBIAN-CVE-2026-42306
Debian:14docker.io28.5.2+dfsg4-3DEBIAN-CVE-2026-42306
Gogithub.com/docker/dockerno fix listedGHSA-rg2x-37c3-w2rh
Gogithub.com/docker/dockerno fix listedGO-2026-5617
Gogithub.com/moby/mobyno fix listedGHSA-rg2x-37c3-w2rh
Gogithub.com/moby/mobyno fix listedGO-2026-5617
Gogithub.com/moby/moby/v22.0.0-beta.14GHSA-rg2x-37c3-w2rh
Gogithub.com/moby/moby/v22.0.0-beta.14GO-2026-5617
Ubuntu:25.10docker.iono fix listedUBUNTU-CVE-2026-42306
Ubuntu:26.04:LTSdocker.iono fix listedUBUNTU-CVE-2026-42306
Ubuntu:26.10docker.iono fix listedUBUNTU-CVE-2026-42306
Ubuntu:25.10docker.io-appno fix listedUBUNTU-CVE-2026-42306
Ubuntu:26.04:LTSdocker.io-appno fix listedUBUNTU-CVE-2026-42306
Ubuntu:26.10docker.io-appno fix listedUBUNTU-CVE-2026-42306

Affected products (as reported)

VendorProductVersions
moby moby github.com/docker/docker/daemon <= 28.5.2Docker Engine < 29.5.1github.com/moby/moby/v2/daemon < 2.0.0-beta.14

Weakness: CWE-61, CWE-367 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H

References