# cve.now: Moby

The newest entries naming Moby as an affected vendor (up to 200), of 59 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-115538](https://cve.now/CVE-2026-115538.md): Docker Engine overlay-network encryption rules are not restored after a firewalld reload (CVSS 7.0)
- [CVE-2026-115539](https://cve.now/CVE-2026-115539.md): Cluster-API proxy overwrites forwarded client identity with its own (CVSS 7.7)
- [CVE-2026-121520](https://cve.now/CVE-2026-121520.md): Malicious client could set xattr value outside of BuildKit state directory (CVSS 4.5)
- [CVE-2026-121522](https://cve.now/CVE-2026-121522.md): Possible panic from Git source resolver (CVSS 6.7)
- [CVE-2026-61801](https://cve.now/CVE-2026-61801.md): github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files (CVSS 5.5)
- [CVE-2026-92543](https://cve.now/CVE-2026-92543.md): Docker Engine insecure-registry fallback via malicious DNS responses (CVSS 7.6)
- [CVE-2026-92542](https://cve.now/CVE-2026-92542.md): Blind VXLAN injection into encrypted overlay networks from cluster peer (CVSS 6.9)
- [CVE-2026-93321](https://cve.now/CVE-2026-93321.md): Malformed LLB file operation can crash buildkitd (CVSS 6.9)
- [CVE-2026-93315](https://cve.now/CVE-2026-93315.md): BuildKit proxy CA cleanup can be disrupted by build steps (CVSS 5.8)
- [CVE-2026-93326](https://cve.now/CVE-2026-93326.md): Crafted Git build source can bypass certain policy validation (CVSS 6.0)
- [CVE-2026-93323](https://cve.now/CVE-2026-93323.md): Oversized Dockerfile or .dockerignore can exhaust buildkitd memory (CVSS 6.8)
- [CVE-2026-93322](https://cve.now/CVE-2026-93322.md): Malformed MergeOp can crash the BuildKit daemon (CVSS 6.9)
- [CVE-2026-93320](https://cve.now/CVE-2026-93320.md): BuildKit improperly handles special files in build snapshots (CVSS 6.0)
- [CVE-2026-93319](https://cve.now/CVE-2026-93319.md): A malicious frontend can cause a daemon panic (CVSS 5.7)
- [CVE-2026-93318](https://cve.now/CVE-2026-93318.md): Cache poisoning via unvalidated image layer DiffIDs (CVSS 7.5)
- [CVE-2026-93317](https://cve.now/CVE-2026-93317.md): Container blob cache can accept unverified content (CVSS 5.9)
- [CVE-2026-93316](https://cve.now/CVE-2026-93316.md): Starting daemon with --cdi-disabled flag can lead to panic on specific builds (CVSS 7.1)
- [CVE-2026-75593](https://cve.now/CVE-2026-75593.md): BuildKit: Malicious client can bypass destination directory validation on local sources upload (CVSS 7.2)
- [CVE-2026-61711](https://cve.now/CVE-2026-61711.md): BuildKit: Custom frontend could bypass Seccomp/AppArmor (CVSS 5.3)
- [CVE-2026-61712](https://cve.now/CVE-2026-61712.md): BuildKit: Possible runtime DoS via unbounded group parsing (CVSS 2.3)
- [CVE-2026-17106](https://cve.now/CVE-2026-17106.md): Tar extraction in moby/go-archive can write outside the destination directory via link following (CVSS 7.1)
- [CVE-2026-15793](https://cve.now/CVE-2026-15793.md): Git source checkout from a bundle file could lead to command injection (CVSS 6.5)
- [CVE-2026-15792](https://cve.now/CVE-2026-15792.md): Possible panic when incorrect parameters sent from frontend (CVSS 6.3)
- [CVE-2026-15791](https://cve.now/CVE-2026-15791.md): LLB file operation can be tricked to remove /tmp directory contents (CVSS 3.3)
- [CVE-2026-15789](https://cve.now/CVE-2026-15789.md): Malicious client can bypass destination directory validation on local sources upload (CVSS 6.9)
- [CVE-2026-15788](https://cve.now/CVE-2026-15788.md): WCOW cache mount source selector resolves NTFS junctions outside of cache root (CVSS 5.6)
- [CVE-2026-42306](https://cve.now/CVE-2026-42306.md): Moby: Race condition in docker cp allows bind mount redirection to host path (CVSS 7.2)
- [CVE-2026-41568](https://cve.now/CVE-2026-41568.md): Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap (CVSS 6.1)
- [CVE-2026-41567](https://cve.now/CVE-2026-41567.md): Docker: \`PUT /containers/{id}/archive\` executes container binary on the host (CVSS 7.2)
- [CVE-2026-35469](https://cve.now/CVE-2026-35469.md): SpdyStream: DOS on CRI (CVSS 8.7)
- [CVE-2026-33997](https://cve.now/CVE-2026-33997.md): Moby: Off-by-one error in plugin privilege validation (CVSS 6.8)
- [CVE-2026-34040](https://cve.now/CVE-2026-34040.md): Moby: AuthZ plugin bypass with oversized request body (CVSS 8.8)
- [CVE-2026-33748](https://cve.now/CVE-2026-33748.md): BuildKit Git URL subdir component can cause access to restricted files (CVSS 8.2)
- [CVE-2026-33747](https://cve.now/CVE-2026-33747.md): BuildKit vulnerable to malicious frontend causing file escape outside of storage root (CVSS 8.4)
- [CVE-2025-54410](https://cve.now/CVE-2025-54410.md): Moby's Firewalld reload removes bridge network isolation (CVSS 3.3)
- [CVE-2025-54388](https://cve.now/CVE-2025-54388.md): Moby's Firewalld reload makes published container ports accessible from remote hosts (CVSS 5.1)
- [CVE-2024-41110](https://cve.now/CVE-2024-41110.md): Moby authz zero length regression (CVSS 10.0)
- [CVE-2024-32473](https://cve.now/CVE-2024-32473.md): Moby IPv6 enabled on IPv4-only network interfaces (CVSS 4.7)
- [CVE-2024-29018](https://cve.now/CVE-2024-29018.md): External DNS requests from 'internal' networks could lead to data exfiltration (CVSS 5.9)
- [CVE-2024-24557](https://cve.now/CVE-2024-24557.md): Moby classic builder cache poisoning (CVSS 6.9)
- [CVE-2024-23653](https://cve.now/CVE-2024-23653.md): BuildKit interactive containers API does not validate entitlements check (CVSS 9.8)
- [CVE-2024-23652](https://cve.now/CVE-2024-23652.md): BuildKit possible host system access from mount stub cleaner (CVSS 10.0)
- [CVE-2024-23651](https://cve.now/CVE-2024-23651.md): BuildKit possible race condition with accessing subpaths from cache mounts (CVSS 8.7)
- [CVE-2024-23650](https://cve.now/CVE-2024-23650.md): BuildKit possible panic when incorrect parameters sent from frontend (CVSS 5.3)
- [CVE-2023-28840](https://cve.now/CVE-2023-28840.md): moby/moby's dockerd daemon encrypted overlay network may be unauthenticated (CVSS 7.5)
- [CVE-2023-28841](https://cve.now/CVE-2023-28841.md): moby/moby's dockerd daemon encrypted overlay network traffic may be unencrypted (CVSS 6.8)
- [CVE-2023-28842](https://cve.now/CVE-2023-28842.md): moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated (CVSS 6.8)
- [CVE-2023-26054](https://cve.now/CVE-2023-26054.md): Credentials inlined to Git URLs could end up in provenance attestation in BuildKit (CVSS 6.5)
- [CVE-2021-32847](https://cve.now/CVE-2021-32847.md): Moby HyperKit uninitialized memory use in virtio-sock pci\_vtsock\_proc\_tx (CVSS 7.1)
- [CVE-2021-32846](https://cve.now/CVE-2021-32846.md): Moby HyperKit uninitialized memory use in virtio-sock pci\_vtsock\_proc\_tx (CVSS 7.7)
- [CVE-2021-32845](https://cve.now/CVE-2021-32845.md): Moby HyperKit uninitialized memory use vtrnd pci\_vtrnd\_notify (CVSS 7.7)
- [CVE-2021-32844](https://cve.now/CVE-2021-32844.md): HyperKit is a toolkit for embedding hypervisor capabilities in an application. (CVSS 6.2)
- [CVE-2021-32843](https://cve.now/CVE-2021-32843.md): HyperKit is a toolkit for embedding hypervisor capabilities in an application. (CVSS 6.2)
- [CVE-2022-36109](https://cve.now/CVE-2022-36109.md): Moby vulnerability relating to supplementary group permissions (CVSS 5.3)
- [CVE-2022-24769](https://cve.now/CVE-2022-24769.md): Default inheritable capabilities for linux container should be empty (CVSS 5.9)
- [CVE-2021-41089](https://cve.now/CVE-2021-41089.md): \`docker cp\` allows unexpected chmod of host files (CVSS 2.8)
- [CVE-2021-41091](https://cve.now/CVE-2021-41091.md): Insufficiently restricted permissions on data directory in Docker Engine (CVSS 6.3)
- [CVE-2021-21284](https://cve.now/CVE-2021-21284.md): privilege escalation in Moby (CVSS 6.8)
- [CVE-2021-21285](https://cve.now/CVE-2021-21285.md): Docker daemon crash during image pull of malicious image (CVSS 6.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/moby
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.