CVE-2025-54388

What it actually does

When Firewalld manages iptables, the Moby daemon does not correctly insert the expected isolation rules for separate bridge networks, allowing containers on different networks to send traffic to each other.

Why it matters to the business

Organizations running container workloads on affected Linux distributions with Firewalld enabled face increased risk of unauthorized data access or lateral movement between supposedly isolated container networks; the issue affects widely used container runtimes and has been present for over a year with only a modest rise in exploit probability.

How an attack unfolds

An attacker obtains the ability to run or influence containers on two different bridge networks, then sends packets between them; because the required drop rules are absent or overridden, the traffic succeeds where isolation was intended.

How to fix it

Upgrade Moby to commit bea959c7b793b32a893820b97c4eadc7c87fabb0 or later; on Alpaquita linux-lts update to 6.6.58-r0 or 6.12.41-r0; after upgrade restart the daemon and verify that cross-network traffic is dropped.

How to confirm the fix worked

Run containers on separate networks, attempt inter-network TCP/UDP connections, and confirm packets are dropped; inspect iptables output for the expected DOCKER-ISOLATION-STAGE-* chains containing REJECT rules when Firewalld is running.

Typical attack path

1. Confirm Firewalld is active on a host running an affected Moby version
2. Create two containers attached to separate user-defined bridge networks
3. From one container attempt to reach a listening service in the other container
4. Observe that the connection succeeds instead of being blocked

How to detect it

Examine dockerd logs for firewalld-related rule creation messages, audit iptables-save output for missing DOCKER-ISOLATION rules on hosts with Firewalld active, and monitor for unexpected successful connections between containers on different networks.

What your security team should do

• Apply the listed package or commit updates immediately on all affected hosts
• Add automated checks that verify cross-network isolation after every daemon restart
• Document environments where Firewalld is required and prioritize them for patching
• Review container network policies to ensure they do not rely solely on the broken isolation