CVE-2026-41567

What it actually does

A path resolution vulnerability in Moby allows for a container escape and arbitrary code execution on the host. When a compressed archive is copied into a container, the Docker daemon incorrectly uses a decompression binary (e.g., `xz`, `unpigz`) from within the container's filesystem instead of the host's. This allows a malicious binary within a container image to be executed with the full privileges of the Docker daemon, which is typically root on the host.

Why it matters to the business

An attacker who can trick a user into running a malicious container can gain complete control over the host server. This breaks the fundamental security isolation between containers and the host, exposing all data, applications, and network connections on that server. A compromised host can be used for data exfiltration, ransomware deployment, or as a pivot point to attack other systems within the corporate network, leading to a significant data breach and operational disruption.

How an attack unfolds

An attacker first crafts a malicious container image. This image appears normal but contains a trojanized version of a common decompression utility, such as `xz` or `unpigz`, in its filesystem. The attacker then publishes this image to a public registry or otherwise tricks a developer or CI/CD system into using it. When a user or an automated process attempts to copy a compressed archive into a running container based on this image (e.g., via `docker cp my-archive.tar.gz container:/tmp/`), the Docker daemon handles the request. To decompress the archive, the daemon mistakenly invokes the trojanized binary from inside the container. This malicious code then executes on the host with the daemon's root privileges, giving the attacker full control over the host machine.

How to fix it

The primary remediation is to upgrade to a patched version. Update Docker Engine to version 29.5.1 or later, or moby/moby to v2.0.0-beta.14 or later. If immediate patching is not feasible, apply the following workarounds: 1. Enforce strict policies to only use container images from trusted, verified internal registries. 2. Use a Docker authorization plugin to restrict or block access to the `PUT /containers/{id}/archive` API endpoint for non-administrative users. 3. Avoid copying compressed archives directly into containers. Instead, decompress archives on the host and copy the uncompressed contents.

How to confirm the fix worked

To confirm remediation, verify that the installed Docker Engine version is 29.5.1 or newer by running the `docker version` command. To assess exposure, audit your environment for running containers based on images from untrusted or public sources. Review CI/CD pipeline scripts and developer documentation for the use of `docker cp` with compressed file extensions (e.g., .gz, .xz, .tgz) being copied into containers.

Typical attack path

1. An attacker creates and publishes a malicious container image containing a trojanized decompression binary.
2. A user or automated system pulls the malicious image and starts a container from it.
3. The user or system attempts to copy a compressed file into the running container using `docker cp` or the associated API endpoint.
4. The Docker daemon on the host resolves and executes the trojanized decompression binary from the container's filesystem.
5. The malicious code executes with root privileges on the host, achieving a container escape and full system compromise.

How to detect it

To detect potential past exploitation, security teams should analyze host and Docker daemon logs for anomalous activity. Look for the `dockerd` process spawning child processes that are unexpected or whose executable paths point to a location within a container's filesystem layers (e.g., `/var/lib/docker/overlay2/...`). Host-based monitoring tools (EDR, auditd) can be used to trace process execution from the `dockerd` parent process. Any suspicious network connections, file modifications, or further process execution originating from `dockerd` that is not part of a standard container lifecycle should be investigated as a potential indicator of compromise.

What your security team should do

• Immediately prioritize patching all Docker Engine instances across development, testing, and production environments to version 29.5.1 or later.
• While patching is in progress, conduct an audit of all container images in use. Identify and investigate any images from untrusted public registries and establish a policy to only use images from a curated, trusted source.
• If patching cannot be performed immediately, implement a Docker authorization plugin to block the vulnerable API endpoint (`PUT /containers/{id}/archive`) as a temporary mitigation.
• Educate developers and DevOps personnel on the risks of this vulnerability and advise against the practice of copying compressed archives into containers, especially those from unvetted sources.