Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap
Priority LOW 26CWE-367Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- Partial Red Hat: 1 fixed, 50 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00108 1st percentileScored 2026-11-07
Fix Partial github.com/moby/moby/v2 (Go): 2.0.0-beta.14Red Hat: 1 advisoryRed Hat: 1 fixed, 50 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| moby | moby | github.com/docker/docker/daemon <= 28.5.2; Docker Engine < 29.5.1; github.com/moby/moby/v2/daemon < 2.0.0-beta.14 | — | No fix listed | CNA |
| — | github.com/docker/docker (Go) | up to 28.5.2 | — | No fix listed | GHSA-vp62-88p7-qqf5 |
| — | github.com/moby/moby/v2 (Go) | before 2.0.0-beta.14 | 2.0.0-beta.14 | Patch available | GHSA-vp62-88p7-qqf5 |
| — | github.com/moby/moby (Go) | up to 28.5.2 | — | No fix listed | GHSA-vp62-88p7-qqf5 |
- moby Vendormoby Affected github.com/docker/docker/daemon <= 28.5.2; Docker Engine < 29.5.1; github.com/moby/moby/v2/daemon < 2.0.0-beta.14 Fixed in — No fix listed CNA
- github.com/docker/docker (Go) Vendor— Affected up to 28.5.2 Fixed in — No fix listed GHSA-vp62-88p7-qqf5
- github.com/moby/moby/v2 (Go) Vendor— Affected before 2.0.0-beta.14 Fixed in 2.0.0-beta.14 Patch available GHSA-vp62-88p7-qqf5
- github.com/moby/moby (Go) Vendor— Affected up to 28.5.2 Fixed in — No fix listed GHSA-vp62-88p7-qqf5
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:docker:engine:*:*:*:*:*:*:*:* | before 29.5.1 | Vulnerable | Docker |
| cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:* | up to 28.5.2 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta0:*:*:*:*:*:* | 2.0.0 beta0 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta1:*:*:*:*:*:* | 2.0.0 beta1 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta10:*:*:*:*:*:* | 2.0.0 beta10 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta11:*:*:*:*:*:* | 2.0.0 beta11 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta12:*:*:*:*:*:* | 2.0.0 beta12 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta13:*:*:*:*:*:* | 2.0.0 beta13 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta2:*:*:*:*:*:* | 2.0.0 beta2 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta3:*:*:*:*:*:* | 2.0.0 beta3 | Vulnerable | Mobyproject |
- cpe:2.3:a:docker:engine:*:*:*:*:*:*:*:* Versions before 29.5.1 Vulnerable ·Docker
- cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:* Versions up to 28.5.2 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta0:*:*:*:*:*:* Versions 2.0.0 beta0 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta1:*:*:*:*:*:* Versions 2.0.0 beta1 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta10:*:*:*:*:*:* Versions 2.0.0 beta10 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta11:*:*:*:*:*:* Versions 2.0.0 beta11 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta12:*:*:*:*:*:* Versions 2.0.0 beta12 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta13:*:*:*:*:*:* Versions 2.0.0 beta13 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta2:*:*:*:*:*:* Versions 2.0.0 beta2 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta3:*:*:*:*:*:* Versions 2.0.0 beta3 Vulnerable ·Mobyproject
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta4:*:*:*:*:*:* | 2.0.0 beta4 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta5:*:*:*:*:*:* | 2.0.0 beta5 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta6:*:*:*:*:*:* | 2.0.0 beta6 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta7:*:*:*:*:*:* | 2.0.0 beta7 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta8:*:*:*:*:*:* | 2.0.0 beta8 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta9:*:*:*:*:*:* | 2.0.0 beta9 | Vulnerable | Mobyproject |
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta4:*:*:*:*:*:* Versions 2.0.0 beta4 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta5:*:*:*:*:*:* Versions 2.0.0 beta5 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta6:*:*:*:*:*:* Versions 2.0.0 beta6 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta7:*:*:*:*:*:* Versions 2.0.0 beta7 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta8:*:*:*:*:*:* Versions 2.0.0 beta8 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta9:*:*:*:*:*:* Versions 2.0.0 beta9 Vulnerable ·Mobyproject
Remediation
- Fix · GHSA-vp62-88p7-qqf5 github.com/moby/moby/v2 (Go) Fixed in 2.0.0-beta.14 Advisory →
Red Hat 1 advisory
- RHSA-2026:37387 Released 2026-07-09 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Affected | No fix yet: Fix deferred |
| Confidential Compute Attestation | Affected | No fix yet: Fix deferred |
| Gatekeeper 3 | Affected | No fix yet: Fix deferred |
| Kernel Module Management Operator for Red Hat Openshift | Affected | No fix yet: Fix deferred |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Logical Volume Manager Storage | Affected | No fix yet: Fix deferred |
| Machine Deletion Remediation Operator | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Virtualization | Affected | No fix yet: Fix deferred |
| Multiarch Tuning Operator | Affected | No fix yet: Fix deferred |
| Multicluster Engine for Kubernetes | Affected | No fix yet: Fix deferred |
| Multicluster Global Hub | Affected | No fix yet: Fix deferred |
| Node HealthCheck Operator | Affected | No fix yet: Fix deferred |
| OpenShift API for Data Protection | Affected | No fix yet: Fix deferred |
| OpenShift Developer Tools and Services | Affected | No fix yet: Fix deferred |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 2 | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| OpenShift Source-to-Image (S2I) | Affected | No fix yet: Fix deferred |
| Pen Drive Powered by Red Hat Lightspeed | Affected | No fix yet: Fix deferred |
| Power monitoring for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Build of Kueue | Affected | No fix yet: Fix deferred |
| Red Hat Build of Podman Desktop - Tech Preview | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 5 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 6 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Edge Manager 1 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| Zero Trust Workload Identity Manager | Affected | No fix yet: Fix deferred |
| Zero Trust Workload Identity Manager - Tech Preview | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4.22 | Fixed | RHSA-2026:37387 |
Not affected: 2 products
- Red Hat Hardened Images
- Red Hat Openshift Data Foundation 4.22
Timeline
- 2026-10-02 Threatist record created from CVE-2026-41568
- 2026-10-03 Alias added: GHSA-vp62-88p7-qqf5
- 2026-10-30 Affected versions changed · Red Hat
References
More moby vulnerabilities
- TI-2026-14229 Tar extraction in moby/go-archive can write outside the destination directory via link following CVSS 4.0HIGH 7.1
- TI-2021-12512 Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx CVSS 3.1HIGH 7.1
- TI-2024-27462 Moby authz zero length regression CVSS 3.1CRITICAL 10.0
- TI-2024-15672 BuildKit interactive containers API does not validate entitlements check CVSS 3.1CRITICAL 9.8
- TI-2024-15671 BuildKit possible host system access from mount stub cleaner CVSS 3.1CRITICAL 10.0
- TI-2026-26365 Moby: AuthZ plugin bypass with oversized request body CVSS 3.1HIGH 8.8
Sources
- CVE-2026-41568 · CVE Program
- CVE-2026-41568 · NVD
- FIRST EPSS
- GHSA-vp62-88p7-qqf5 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-41568 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences