Read the docs
TI-2026-26337 Aliases CVE-2026-33997GHSA-pxq6-2prw-chj9

Moby: Off-by-one error in plugin privilege validation

Priority LOW 37CWE-193Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 3 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-193 and the CVSS impact.

Summary

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00402 34th percentileScored 2026-11-07
Fix Partial moby (moby): 29.3.1github.com/moby/moby/v2 (Go): 2.0.0-beta.8Red Hat: 3 advisoriesRed Hat: 3 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mobymobybefore 29.3.129.3.1Patch availableCNA
—github.com/docker/docker (Go)all versions—No fix listedGHSA-pxq6-2prw-chj9
—github.com/moby/moby/v2 (Go)before 2.0.0-beta.82.0.0-beta.8Patch availableGHSA-pxq6-2prw-chj9
—github.com/moby/moby (Go)all versions—No fix listedGHSA-pxq6-2prw-chj9
  • moby Vendormoby Affected before 29.3.1 Fixed in 29.3.1 Patch available CNA
  • github.com/docker/docker (Go) Vendor— Affected all versions Fixed in — No fix listed GHSA-pxq6-2prw-chj9
  • github.com/moby/moby/v2 (Go) Vendor— Affected before 2.0.0-beta.8 Fixed in 2.0.0-beta.8 Patch available GHSA-pxq6-2prw-chj9
  • github.com/moby/moby (Go) Vendor— Affected all versions Fixed in — No fix listed GHSA-pxq6-2prw-chj9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:docker:engine:*:*:*:*:*:*:*:*before 29.3.1VulnerableDocker
  • cpe:2.3:a:docker:engine:*:*:*:*:*:*:*:* Versions before 29.3.1 Vulnerable ·Docker

Remediation

  • Fix · CNA moby (moby) Fixed in 29.3.1
  • Fix · GHSA-pxq6-2prw-chj9 github.com/moby/moby/v2 (Go) Fixed in 2.0.0-beta.8 Advisory →

Red Hat 3 advisories

  • RHSA-2026:23345 Released 2026-06-04 · Red Hat rating Important
    Multicluster Global Hub 1.6.2 security update
    • Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:22347 Released 2026-06-01 · Red Hat rating Important
    Multicluster Global Hub 1.4.5 security update
    • Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:21769 Released 2026-05-28 · Red Hat rating Important
    Multicluster Global Hub 1.5.4 security update
    • Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Multicluster Engine for KubernetesAffectedNo fix yet
Red Hat OpenShift Container Platform 4Affected—
Multicluster Global Hub 1.4.9Fixed RHSA-2026:22347
Multicluster Global Hub 1.6.5Fixed RHSA-2026:23345
Red Hat multicluster global hub 1.5.3Fixed RHSA-2026:21769
Not affected: 7 products
  • Multicluster Global Hub 1.4.9
  • Multicluster Global Hub 1.6.5
  • OpenShift Service Mesh 2
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Virtualization 4
  • Red Hat multicluster global hub 1.5.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33997
  2. 2026-10-03 Alias added: GHSA-pxq6-2prw-chj9

References

Advisory 2

Other 4

  • TI-2026-14229 Tar extraction in moby/go-archive can write outside the destination directory via link following CVSS 4.0HIGH 7.1
  • TI-2021-12512 Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx CVSS 3.1HIGH 7.1
  • TI-2024-27462 Moby authz zero length regression CVSS 3.1CRITICAL 10.0
  • TI-2024-15672 BuildKit interactive containers API does not validate entitlements check CVSS 3.1CRITICAL 9.8
  • TI-2024-15671 BuildKit possible host system access from mount stub cleaner CVSS 3.1CRITICAL 10.0
  • TI-2026-26365 Moby: AuthZ plugin bypass with oversized request body CVSS 3.1HIGH 8.8
See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences