CVE-2026-41567Docker: `PUT /containers/{id}/archive` executes container binary on the host
Updated under an hour ago ()
Does this affect you?
It affects moby/v2/daemon and 15 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images
- CVSS
- 7.2 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
- Weakness (CWE)
- CWE-427
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Awaiting Analysis
- Record last updated
- Sep 9, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
moby moby/v2/daemon moby:v2_daemon (from the name) | before 2.0.0-beta.14 | CNA record |
moby Docker Engine moby:docker_engine (from the name) | before 29.5.1 | CNA record |
docker docker/daemon docker:daemon (from the name) | through 28.5.2 | CNA record |
Red Hat Multicluster Global Hub 1.4.5 redhat:multicluster_globalhub | from 1784060681 not affected | CISA ADP |
Red Hat OpenShift Developer Tools and Services 1.6.3 redhat:source_to_image | from 1784727697 not affected | CISA ADP |
Red Hat Red Hat Openshift Data Foundation 4.22 redhat:openshift_data_foundation | from 1782932114 not affected | CISA ADP |
Red Hat Exploit Intelligence redhat:exploit_intelligence | 0 | CISA ADP |
Red Hat Multicluster Engine for Kubernetes redhat:multicluster_engine | All versions | CISA ADP |
Red Hat OpenShift Lightspeed redhat:openshift_lightspeed | All versions | CISA ADP |
2 | CISA ADP | |
Red Hat Red Hat Ceph Storage 5 redhat:ceph_storage | 5 | CISA ADP |
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux | 10 | CISA ADP |
Red Hat Red Hat Hardened Images redhat:hummingbird | 1 | CISA ADP |
Red Hat Red Hat OpenShift AI (RHOAI) redhat:openshift_ai | All versions | CISA ADP |
Red Hat Red Hat OpenShift Container Platform 4 redhat:openshift | 4 | CISA ADP |
Red Hat Red Hat OpenShift distributed tracing 3 redhat:openshift_distributed_tracing | 3 | CISA ADP |
References
- https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2rx-refsource-confirm
- https://access.redhat.com/errata/RHSA-2026:37387
- https://access.redhat.com/errata/RHSA-2026:41030
- https://access.redhat.com/errata/RHSA-2026:42852
- https://access.redhat.com/errata/RHSA-2026:44622
- https://access.redhat.com/errata/RHSA-2026:51057
- https://access.redhat.com/security/cve/CVE-2026-41567
- https://bugzilla.redhat.com/show_bug.cgi?id=2485356
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41567.json
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.