Moby vulnerabilities
59 CVEs and advisories name Moby as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-33997Moby: Off-by-one error in plugin privilege validation
- CVE-2026-34040Moby: AuthZ plugin bypass with oversized request body
- CVE-2026-33748BuildKit Git URL subdir component can cause access to restricted files
- CVE-2026-33747BuildKit vulnerable to malicious frontend causing file escape outside of storage root
- CVE-2025-54410Moby's Firewalld reload removes bridge network isolation
- CVE-2025-54388Moby's Firewalld reload makes published container ports accessible from remote hosts
- CVE-2024-41110Moby authz zero length regression
- CVE-2024-32473Moby IPv6 enabled on IPv4-only network interfaces
- CVE-2024-29018External DNS requests from 'internal' networks could lead to data exfiltration
- CVE-2024-24557Moby classic builder cache poisoning
- CVE-2024-23653BuildKit interactive containers API does not validate entitlements check
- CVE-2024-23652BuildKit possible host system access from mount stub cleaner
- CVE-2024-23651BuildKit possible race condition with accessing subpaths from cache mounts
- CVE-2024-23650BuildKit possible panic when incorrect parameters sent from frontend
- CVE-2023-28840moby/moby's dockerd daemon encrypted overlay network may be unauthenticated
- CVE-2023-28841moby/moby's dockerd daemon encrypted overlay network traffic may be unencrypted
- CVE-2023-28842moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated
- CVE-2023-26054Credentials inlined to Git URLs could end up in provenance attestation in BuildKit
- CVE-2021-32847Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx
- CVE-2021-32846Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx
- CVE-2021-32845Moby HyperKit uninitialized memory use vtrnd pci_vtrnd_notify
- CVE-2021-32844HyperKit is a toolkit for embedding hypervisor capabilities in an application.
- CVE-2021-32843HyperKit is a toolkit for embedding hypervisor capabilities in an application.
- CVE-2022-36109Moby vulnerability relating to supplementary group permissions
- CVE-2022-24769Default inheritable capabilities for linux container should be empty
- CVE-2021-41089`docker cp` allows unexpected chmod of host files
- CVE-2021-41091Insufficiently restricted permissions on data directory in Docker Engine
- CVE-2021-21284privilege escalation in Moby
- CVE-2021-21285Docker daemon crash during image pull of malicious image