CVE-2025-54410

What it actually does

The Moby daemon fails to generate correct iptables rules via the Firewalld backend, allowing traffic between containers attached to separate bridge networks that should be isolated.

Why it matters to the business

Organizations running container workloads on Firewalld-managed Linux hosts face a risk of unintended network access between isolated applications, increasing exposure of internal services even though the overall likelihood remains low.

How an attack unfolds

An attacker with the ability to launch containers on the affected host creates workloads on two different bridge networks and sends traffic from one to the other; because the expected isolation rules are absent or ineffective, the packets are permitted instead of dropped.

How to fix it

Upgrade Moby to the version containing commit 165516eb478021fdc99976e5aadc26bf73c1e51b or later. After upgrading, restart the daemon and verify that Firewalld-managed iptables rules correctly enforce bridge-network isolation.

How to confirm the fix worked

After applying the fix, start containers on separate bridge networks and confirm that cross-network traffic is blocked using standard network tools; also inspect the generated iptables rules under the Firewalld backend to ensure isolation chains are present and populated.

Typical attack path

1. Obtain the ability to start containers on the Docker host
2. Create containers attached to two distinct bridge networks
3. From one container, attempt network connections to services running in the other container
4. Observe that traffic succeeds due to missing isolation rules

How to detect it

Examine Docker daemon logs and Firewalld iptables rule dumps for missing or incomplete isolation chains between bridge networks; look for unexpected successful connections between containers on different networks in host and container network flow logs.

What your security team should do

• Prioritize upgrade of Moby on any hosts using Firewalld for firewall management
• Review container network policies to ensure they do not rely solely on the now-corrected isolation behavior
• Monitor for future updates to the Moby Firewalld integration