DC/OS Marathon UI < 1.9.0 Unauthenticated RCE via Docker Mount Abuse
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations, attackers can deploy a container that mounts the host's root filesystem (/) with read/write privileges. When using a malicious Docker image, the attacker can write to /etc/cron.d/ on the host, achieving arbitrary code execution with root privileges. This impacts any system where the Docker daemon honors Marathon container configurations without policy enforcement.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| D2iQ, Inc. | DC/OS Marathon | before 1.9.0 | 1.9.0 | Patch available | CNA |
- DC/OS Marathon VendorD2iQ, Inc. Affected before 1.9.0 Fixed in 1.9.0 Patch available CNA
Remediation
- Fix · CNA DC/OS Marathon (D2iQ, Inc.) Fixed in 1.9.0
Timeline
- 2026-10-02 Threatist record created from CVE-2017-20198
- 2026-10-03 Alias added: GHSA-24rw-3m8c-crv2
References
More D2iQ, Inc. vulnerabilities
- TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
Sources
- CVE-2017-20198 · CVE Program
- CVE-2017-20198 · NVD
- FIRST EPSS
- GHSA-24rw-3m8c-crv2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences