Moby: Race condition in docker cp allows bind mount redirection to host path
Priority LOW 30CWE-367Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Partial Red Hat: 10 fixed, 38 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00104 1st percentileScored 2026-11-07
Fix Partial github.com/moby/moby/v2 (Go): 2.0.0-beta.14Red Hat: 10 advisoriesRed Hat: 10 fixed, 38 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| moby | moby | github.com/docker/docker/daemon <= 28.5.2; Docker Engine < 29.5.1; github.com/moby/moby/v2/daemon < 2.0.0-beta.14 | — | No fix listed | CNA |
| — | github.com/docker/docker (Go) | up to 28.5.2 | — | No fix listed | GHSA-rg2x-37c3-w2rh |
| — | github.com/moby/moby/v2 (Go) | before 2.0.0-beta.14 | 2.0.0-beta.14 | Patch available | GHSA-rg2x-37c3-w2rh |
| — | github.com/moby/moby (Go) | up to 28.5.2 | — | No fix listed | GHSA-rg2x-37c3-w2rh |
- moby Vendormoby Affected github.com/docker/docker/daemon <= 28.5.2; Docker Engine < 29.5.1; github.com/moby/moby/v2/daemon < 2.0.0-beta.14 Fixed in — No fix listed CNA
- github.com/docker/docker (Go) Vendor— Affected up to 28.5.2 Fixed in — No fix listed GHSA-rg2x-37c3-w2rh
- github.com/moby/moby/v2 (Go) Vendor— Affected before 2.0.0-beta.14 Fixed in 2.0.0-beta.14 Patch available GHSA-rg2x-37c3-w2rh
- github.com/moby/moby (Go) Vendor— Affected up to 28.5.2 Fixed in — No fix listed GHSA-rg2x-37c3-w2rh
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:docker:engine:*:*:*:*:*:*:*:* | before 29.5.1 | Vulnerable | Docker |
| cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:* | up to 28.5.2 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta0:*:*:*:*:*:* | 2.0.0 beta0 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta1:*:*:*:*:*:* | 2.0.0 beta1 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta10:*:*:*:*:*:* | 2.0.0 beta10 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta11:*:*:*:*:*:* | 2.0.0 beta11 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta12:*:*:*:*:*:* | 2.0.0 beta12 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta13:*:*:*:*:*:* | 2.0.0 beta13 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta2:*:*:*:*:*:* | 2.0.0 beta2 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta3:*:*:*:*:*:* | 2.0.0 beta3 | Vulnerable | Mobyproject |
- cpe:2.3:a:docker:engine:*:*:*:*:*:*:*:* Versions before 29.5.1 Vulnerable ·Docker
- cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:* Versions up to 28.5.2 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta0:*:*:*:*:*:* Versions 2.0.0 beta0 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta1:*:*:*:*:*:* Versions 2.0.0 beta1 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta10:*:*:*:*:*:* Versions 2.0.0 beta10 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta11:*:*:*:*:*:* Versions 2.0.0 beta11 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta12:*:*:*:*:*:* Versions 2.0.0 beta12 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta13:*:*:*:*:*:* Versions 2.0.0 beta13 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta2:*:*:*:*:*:* Versions 2.0.0 beta2 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta3:*:*:*:*:*:* Versions 2.0.0 beta3 Vulnerable ·Mobyproject
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta4:*:*:*:*:*:* | 2.0.0 beta4 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta5:*:*:*:*:*:* | 2.0.0 beta5 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta6:*:*:*:*:*:* | 2.0.0 beta6 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta7:*:*:*:*:*:* | 2.0.0 beta7 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta8:*:*:*:*:*:* | 2.0.0 beta8 | Vulnerable | Mobyproject |
| cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta9:*:*:*:*:*:* | 2.0.0 beta9 | Vulnerable | Mobyproject |
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta4:*:*:*:*:*:* Versions 2.0.0 beta4 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta5:*:*:*:*:*:* Versions 2.0.0 beta5 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta6:*:*:*:*:*:* Versions 2.0.0 beta6 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta7:*:*:*:*:*:* Versions 2.0.0 beta7 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta8:*:*:*:*:*:* Versions 2.0.0 beta8 Vulnerable ·Mobyproject
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta9:*:*:*:*:*:* Versions 2.0.0 beta9 Vulnerable ·Mobyproject
Remediation
- Fix · GHSA-rg2x-37c3-w2rh github.com/moby/moby/v2 (Go) Fixed in 2.0.0-beta.14 Advisory →
Red Hat 10 advisories
- RHSA-2026:68334 Released 2026-09-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.4 Security Update
- RHEM 1.1 for RHEL 10 flightctl-1.1.4-1.el10em, flightctl-agent-1.1.4-1.el10em, flightctl-cli-1.1.4-1.el10em
- RHEM 1.1 for RHEL 9 flightctl-1.1.4-1.el9em, flightctl-agent-1.1.4-1.el9em, flightctl-cli-1.1.4-1.el9em
- RHSA-2026:68253 Released 2026-09-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.4 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +10
- RHSA-2026:68044 Released 2026-09-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.4 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
Show 7 more Red Hat advisories
- RHSA-2026:59467 Released 2026-08-25 · Red Hat rating ImportantRed Hat OpenShift API for Data Protection
- OpenShift API for Data Protection 1.4 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +3
- RHSA-2026:55810 Released 2026-08-17 · Red Hat rating CriticalMulticluster Global Hub 1.4.8 security update
- Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator
- RHSA-2026:54577 Released 2026-08-13 · Red Hat rating CriticalMulticluster Global Hub 1.5.7 security update
- Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator
- RHSA-2026:54392 Released 2026-08-12 · Red Hat rating CriticalMulticluster Global Hub 1.6.5 security update
- Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator
- RHSA-2026:53530 Released 2026-08-11 · Red Hat rating CriticalMulticluster Global Hub 1.7.2 security update
- Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:51057 Released 2026-08-06 · Red Hat rating ImportantOpenShift Source To Image 1.6.3
- OpenShift Developer Tools and Services 1.6.4 registry.redhat.io/source-to-image/source-to-image-rhel8, registry.redhat.io/source-to-image/source-to-image-rhel9
- RHSA-2026:51033 Released 2026-08-06 · Red Hat rating ImportantRed Hat OpenShift API for Data Protection
- OpenShift API for Data Protection 1.3 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +7
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Affected | No fix yet |
| Confidential Compute Attestation | Affected | No fix planned: Will not fix |
| Kernel Module Management Operator for Red Hat Openshift | Affected | No fix yet: Fix deferred |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Logical Volume Manager Storage | Affected | No fix yet: Fix deferred |
| Machine Deletion Remediation Operator | Affected | No fix yet |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Virtualization | Affected | No fix yet: Fix deferred |
| Multiarch Tuning Operator | Affected | No fix yet: Fix deferred |
| Multicluster Engine for Kubernetes | Affected | No fix yet |
| Node HealthCheck Operator | Affected | No fix yet |
| OpenShift API for Data Protection | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix yet: Fix deferred |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet |
| OpenShift Service Mesh 2 | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Power monitoring for Red Hat OpenShift | Affected | No fix yet |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Build of Kueue | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 5 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 6 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Zero Trust Workload Identity Manager | Affected | No fix yet: Fix deferred |
| Zero Trust Workload Identity Manager - Tech Preview | Affected | No fix yet: Fix deferred |
| Multicluster Global Hub 1.4.9 | Fixed | RHSA-2026:55810 |
| Multicluster Global Hub 1.5.8 | Fixed | RHSA-2026:54577 |
| Multicluster Global Hub 1.6.6 | Fixed | RHSA-2026:54392 |
| Multicluster Global Hub 1.7.4 | Fixed | RHSA-2026:53530 |
| OpenShift API for Data Protection 1.3 | Fixed | RHSA-2026:51033 |
| OpenShift API for Data Protection 1.4 | Fixed | RHSA-2026:59467 |
| OpenShift Developer Tools and Services 1.6.4 | Fixed | RHSA-2026:51057 |
| RHEM 1.1 for RHEL 10 | Fixed | RHSA-2026:68334 |
| RHEM 1.1 for RHEL 9 | Fixed | RHSA-2026:68334 |
| Red Hat Edge Manager 1.1 | Fixed | RHSA-2026:68044, RHSA-2026:68253 |
Not affected: 28 products
- Gatekeeper 3
- Migration Toolkit for Containers
- Migration Toolkit for Virtualization
- Multicluster Engine for Kubernetes
- Multicluster Global Hub 1.4.9
- Multicluster Global Hub 1.5.8
- Multicluster Global Hub 1.6.6
- Multicluster Global Hub 1.7.4
- OpenShift API for Data Protection 1.3
- OpenShift API for Data Protection 1.4
- OpenShift Developer Tools and Services
- OpenShift Pipelines
- Pen Drive Powered by Red Hat Lightspeed
- RHEM 1.1 for RHEL 10
- RHEM 1.1 for RHEL 9
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ansible Automation Platform 2
- Red Hat Build of Podman Desktop - Tech Preview
- Red Hat Edge Manager 1.1
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Dev Spaces
- Red Hat Trusted Artifact Signer
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42306
- 2026-10-03 Alias added: GHSA-rg2x-37c3-w2rh
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-11-06 Fix available: Multicluster Global Hub 1.7.4 · Red Hat
References
More moby vulnerabilities
- TI-2026-14229 Tar extraction in moby/go-archive can write outside the destination directory via link following CVSS 4.0HIGH 7.1
- TI-2021-12512 Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx CVSS 3.1HIGH 7.1
- TI-2024-27462 Moby authz zero length regression CVSS 3.1CRITICAL 10.0
- TI-2024-15672 BuildKit interactive containers API does not validate entitlements check CVSS 3.1CRITICAL 9.8
- TI-2024-15671 BuildKit possible host system access from mount stub cleaner CVSS 3.1CRITICAL 10.0
- TI-2026-26365 Moby: AuthZ plugin bypass with oversized request body CVSS 3.1HIGH 8.8
Sources
- CVE-2026-42306 · CVE Program
- CVE-2026-42306 · NVD
- FIRST EPSS
- GHSA-rg2x-37c3-w2rh · GitHub Advisory Database · CC BY 4.0
- CVE-2026-42306 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences