CVE-2026-34040

What it actually does

The vulnerability allows a local attacker with low privileges to bypass authorization (AuthZ) plugins. Due to a scope change (S:C), the attacker can escape the intended security context of a container and execute commands or access resources on the underlying host system with high privileges, leading to a full compromise of the host's confidentiality, integrity, and availability.

Why it matters to the business

An attacker can escalate privileges from a container to gain complete control of the host system. This could lead to the compromise of all applications running on the host, theft or manipulation of sensitive data, service disruption, and the use of the compromised system as a pivot point for further attacks within the network. The relatively high EPSS score indicates a significant likelihood of exploitation, increasing the urgency for remediation.

How an attack unfolds

An attacker with initial low-privileged access to a container on a vulnerable host crafts a specific API request to the container daemon. The daemon fails to correctly consult or enforce the decision of the configured authorization plugin. As a result, the attacker's unauthorized request to perform a privileged action, such as creating a new container with elevated permissions or mounting a sensitive host directory, is improperly granted. This allows the attacker to break out of the container's isolation and achieve arbitrary code execution on the host system, effectively escalating their privileges to root.

How to fix it

To remediate this vulnerability, upgrade Moby or its downstream distributions (like Docker Engine) to version 29.3.1 or later. If an immediate upgrade is not feasible, mitigate the risk by strictly limiting access to the container daemon API, avoiding exposure of the Docker socket to containerized processes, and applying the principle of least privilege for all users interacting with the container runtime.

How to confirm the fix worked

To confirm remediation, verify that the installed version of the container engine is 29.3.1 or newer by running the appropriate version check command (e.g., `docker --version`). To test for exposure, configure an authorization plugin to deny a specific action (e.g., creating privileged containers) and then attempt that action as a non-admin user. If the action is correctly blocked, the vulnerability is likely mitigated. If the action succeeds, the system remains vulnerable.

Typical attack path

1. Attacker gains initial access to a container, either as a legitimate low-privileged user or through a separate vulnerability.
2. The attacker crafts and sends a malicious API call to the container daemon to perform a privileged operation.
3. The vulnerable daemon processes the request but fails to properly enforce the configured authorization plugin's policy, bypassing the security control.
4. The attacker's request is successfully executed, granting them elevated capabilities, such as mounting host file systems into a container.
5. The attacker leverages this access to escape the container and gain full administrative control over the host system.

How to detect it

Monitor container daemon audit logs for successful privileged operations that should have been denied by your authorization plugin. Look for events such as container creation with the `--privileged` flag, or host path volume mounts (`-v /:/host`) that violate security policy, especially when initiated by non-administrative users. Correlate these API logs with process execution monitoring on the host to detect suspicious commands originating from container processes. A successful exploit would likely result in anomalous shell activity or file access on the host originating from a container's process namespace.

What your security team should do

• Immediately prioritize patching all container hosts running vulnerable versions of Moby/Docker Engine to 29.3.1 or a later release.
• Audit container daemon logs for any successful privileged operations (e.g., creating privileged containers, mounting sensitive host paths) initiated by unexpected user accounts.
• Implement runtime security monitoring tools to detect and alert on potential container escape behavior and anomalous process execution on container hosts.
• Review and enforce strict access control policies for the container daemon API, ensuring only trusted administrative users can interact with it.