Moby vulnerabilities
We track 24 vulnerabilities in Moby products across 6 products. 24 are rated high or critical, and none are known to be exploited. The most recent was published on November 10, 2026.
Latest Moby vulnerabilities
- 7.7 High severity
SwarmKit: Unintended Proxy or Intermediary
SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when built
- 7.0 High severity
Docker Engine: Protection Mechanism Failure
Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload or start signals over D-Bus. Th
- 7.6 High severity
Docker Engine: Improper Certificate Validation
Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single addr
- 7.5 High severity
BuildKit: Improper Validation of Integrity Check Value
A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer co
- 7.1 High severity
BuildKit: NULL Pointer Dereference
If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident.
- 7.2 High severity
buildkit: Improper Limitation of a Pathname to a Restricted Directory
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled
- 7.1 High severity
go-archive: Improper Link Resolution Before File Access
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical stri
- 7.5 High severity
BuildKit: Improper Neutralization of Argument Delimiters in a Command
BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.
- 7.5 High severity
BuildKit: Improper Limitation of a Pathname to a Restricted Directory
A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory.
- 7.5 High severity
BuildKit: Improper Limitation of a Pathname to a Restricted Directory
A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentica
- 7.5 High severity
BuildKit: Improper Link Resolution Before File Access
BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host fil
- 7.2 High severity
moby: UNIX Symbolic Link (Symlink) Following
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirec
- 7.2 High severity
moby/v2/daemon: Uncontrolled Search Path Element
Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves dec
- 7.8 High severity
moby: Authentication Bypass Using an Alternate Path or Channel
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.
- 8.1 High severity
moby: Off-by-one Error
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, th
- 7.5 High severity
buildkit: Improper Limitation of a Pathname to a Restricted Directory
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git
- 9.8 Critical severity
buildkit: Improper Limitation of a Pathname to a Restricted Directory
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside
- 9.9 Critical severity
moby: Partial String Comparison
Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances.
- 7.5 High severity
moby: Incorrect Resource Transfer Between Spheres
Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and g
- 7.8 High severity
moby: Origin Validation Error
Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBU
- 9.8 Critical severity
buildkit: Incorrect Authorization
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It wa
- 9.1 Critical severity
buildkit: Improper Limitation of a Pathname to a Restricted Directory
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints in
- 7.4 High severity
buildkit: Concurrent Execution using Shared Resource with Improper Synchronization
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files
- 8.7 High severity
moby: Observable Discrepancy
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby, is commonly r