CVE-2024-41110

What it actually does

The vulnerability permits an Engine API client to issue specially crafted requests that cause the daemon to forward traffic to AuthZ plugins without including the request or response body, allowing bypass of plugins that base authorization decisions on body content.

Why it matters to the business

Organizations relying on authorization plugins for access control in container environments face risk of unauthorized container actions including privilege escalation; the issue is a regression of a prior fix and affects many Docker deployments until upgraded.

How an attack unfolds

An attacker with access to the Docker Engine API crafts a request that omits the body payload; the daemon forwards the incomplete request to the AuthZ plugin, which then grants access it would have denied if the full body had been inspected, enabling unauthorized operations.

How to fix it

Upgrade immediately to docker-ce v27.1.1 or the patched releases in the 19.03, 20.0, 23.0, 24.0, 25.0, 26.0, or 26.1 branches; if immediate upgrade is not possible, disable AuthZ plugins or restrict Docker API access to trusted clients only under least privilege.

How to confirm the fix worked

Verify the installed Docker Engine version matches a patched release; test AuthZ plugin behavior by sending both complete and body-omitted requests to confirm the plugin now receives full payloads before making decisions.

Typical attack path

1. Obtain network or local access to the Docker Engine API endpoint
2. Identify that an AuthZ plugin relying on request/response bodies is in use
3. Craft and send an API request deliberately omitting the body content
4. Receive authorization approval for an action that should have been denied
5. Perform the unauthorized container operation such as image pull or container start

How to detect it

Review Docker daemon logs and API access logs for requests that appear truncated or lack expected body content; correlate with AuthZ plugin decision logs to identify cases where authorization was granted without full request inspection.

What your security team should do

• Prioritize upgrade of all Docker Engine instances to the fixed versions listed in remediation guidance
• Audit environments for active use of AuthZ plugins that inspect request bodies
• Temporarily restrict Docker API exposure while upgrades are applied
• Monitor EPSS and exploit maturity indicators for any increase in observed attempts