Read the docs
TI-2026-26365 Aliases CVE-2026-34040GHSA-x744-4wpc-v9h2

Moby: AuthZ plugin bypass with oversized request body

Priority MEDIUM 52CWE-288Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 4 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-288.

Summary

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0927 95th percentileScored 2026-11-07
Fix Partial moby (moby): 29.3.1github.com/moby/moby (Go): 29.3.1+1 more productRed Hat: 8 advisoriesRed Hat: 4 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mobymobybefore 29.3.129.3.1Patch availableCNA
—github.com/moby/moby (Go)before 29.3.129.3.1Patch availableGHSA-x744-4wpc-v9h2
—github.com/moby/moby/v2 (Go)before 2.0.0-beta.82.0.0-beta.8Patch availableGHSA-x744-4wpc-v9h2
  • moby Vendormoby Affected before 29.3.1 Fixed in 29.3.1 Patch available CNA
  • github.com/moby/moby (Go) Vendor— Affected before 29.3.1 Fixed in 29.3.1 Patch available GHSA-x744-4wpc-v9h2
  • github.com/moby/moby/v2 (Go) Vendor— Affected before 2.0.0-beta.8 Fixed in 2.0.0-beta.8 Patch available GHSA-x744-4wpc-v9h2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:docker:engine:*:*:*:*:*:*:*:*before 29.3.1VulnerableDocker
  • cpe:2.3:a:docker:engine:*:*:*:*:*:*:*:* Versions before 29.3.1 Vulnerable ·Docker

Remediation

  • Fix · CNA moby (moby) Fixed in 29.3.1
  • Fix · GHSA-x744-4wpc-v9h2 github.com/moby/moby (Go) Fixed in 29.3.1 Advisory →
  • Fix · GHSA-x744-4wpc-v9h2 github.com/moby/moby/v2 (Go) Fixed in 2.0.0-beta.8 Advisory →

Red Hat 8 advisories

  • RHSA-2026:73419 Released 2026-09-29 · Red Hat rating Important
    Multicluster Global Hub 1.6.6 security update
    • Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:71597 Released 2026-09-24 · Red Hat rating Important
    Multicluster Global Hub 1.5.8 security update
    • Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:67842 Released 2026-09-16 · Red Hat rating Important
    Multicluster Global Hub 1.7.3 security update
    • Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
Show 5 more Red Hat advisories
  • RHSA-2026:67516 Released 2026-09-15 · Red Hat rating Important
    Multicluster Global Hub 1.4.9 security update
    • Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:24503 Released 2026-06-08 · Red Hat rating Important
    Multicluster Global Hub 1.7.1 security update
    • Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9
  • RHSA-2026:23345 Released 2026-06-04 · Red Hat rating Important
    Multicluster Global Hub 1.6.2 security update
    • Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:22347 Released 2026-06-01 · Red Hat rating Important
    Multicluster Global Hub 1.4.5 security update
    • Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:21769 Released 2026-05-28 · Red Hat rating Important
    Multicluster Global Hub 1.5.4 security update
    • Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Multicluster Engine for KubernetesAffectedNo fix yet
Red Hat Ceph Storage 5AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Multicluster Global Hub 1.4.9Fixed RHSA-2026:22347, RHSA-2026:67516
Multicluster Global Hub 1.5.8Fixed RHSA-2026:21769, RHSA-2026:71597
Multicluster Global Hub 1.6.6Fixed RHSA-2026:23345, RHSA-2026:73419
Multicluster Global Hub 1.7.3Fixed RHSA-2026:24503, RHSA-2026:67842
Not affected: 9 products
  • Multicluster Engine for Kubernetes
  • Multicluster Global Hub 1.4.9
  • Multicluster Global Hub 1.5.8
  • Multicluster Global Hub 1.6.6
  • Multicluster Global Hub 1.7.3
  • OpenShift Service Mesh 2
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Virtualization 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34040
  2. 2026-10-03 Alias added: GHSA-x744-4wpc-v9h2
  3. 2026-10-25 EPSS moved to the 95th–99th percentile
  4. 2026-10-25 Priority changed: LOW → MEDIUM

References

Advisory 2

Other 5

  • TI-2026-14229 Tar extraction in moby/go-archive can write outside the destination directory via link following CVSS 4.0HIGH 7.1
  • TI-2021-12512 Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx CVSS 3.1HIGH 7.1
  • TI-2024-27462 Moby authz zero length regression CVSS 3.1CRITICAL 10.0
  • TI-2024-15672 BuildKit interactive containers API does not validate entitlements check CVSS 3.1CRITICAL 9.8
  • TI-2024-15671 BuildKit possible host system access from mount stub cleaner CVSS 3.1CRITICAL 10.0
  • TI-2026-27599 SpdyStream: DOS on CRI CVSS 4.0HIGH 8.7
See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences