CVE-2025-54388
published 2025-07-30CVE-2025-54388: Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other…
PriorityP421medium4.6CVSS 3.1
AVAACLPRNUIRSUCLILAN
EPSS
0.21%
11.8th percentile
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | docker.io | — | — |
| github.com | docker_docker | >= 28.2.0 < 28.3.3 | 28.3.3 |
| github.com | docker_docker | >= 28.2.0+incompatible < 28.3.3+incompatible | 28.3.3+incompatible |
| moby | moby | — | — |
| mobyproject | moby | >= 28.2.0 < 28.3.3 | 28.3.3 |
CVSS provenance
nvdv3.14.6MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
nvdv4.05.1MEDIUMCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv5.1MEDIUM
vendor_debian5.1LOW
vendor_redhat5.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
github.com/moby/moby: Moby's Firewalld reload makes container ports accessible
vendor_redhat·2025-07-30·CVSS 5.1
CVE-2025-54388 [MEDIUM] CWE-909 github.com/moby/moby: Moby's Firewalld reload makes container ports accessible
github.com/moby/moby: Moby's Firewalld reload makes container ports accessible
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible fro
Debian
CVE-2025-54388: docker.io - Moby is an open source container framework developed by Docker Inc. that is dist...
vendor_debian·2025·CVSS 5.1
CVE-2025-54388 [MEDIUM] CVE-2025-54388: docker.io - Moby is an open source container framework developed by Docker Inc. that is dist...
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - u
OSV
Moby firewalld reload makes published container ports accessible from remote hosts in github.com/docker/docker
osv·2025-08-11
CVE-2025-54388 Moby firewalld reload makes published container ports accessible from remote hosts in github.com/docker/docker
Moby firewalld reload makes published container ports accessible from remote hosts in github.com/docker/docker
Moby firewalld reload makes published container ports accessible from remote hosts in github.com/docker/docker
OSV
CVE-2025-54388: Moby is an open source container framework developed by Docker Inc
osv·2025-07-30·CVSS 5.1
CVE-2025-54388 [MEDIUM] CVE-2025-54388: Moby is an open source container framework developed by Docker Inc
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - u
OSV
Moby firewalld reload makes published container ports accessible from remote hosts
osv·2025-07-29
CVE-2025-54388 [MEDIUM] Moby firewalld reload makes published container ports accessible from remote hosts
Moby firewalld reload makes published container ports accessible from remote hosts
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (dockerd), which is developed as [moby/moby](https://github.com/moby/moby) is commonly referred to as Docker, or Docker Engine.
Firewalld is a daemon used by some Linux distributions to provide a dynamically managed firewall. When Firewalld is running, Docker uses its iptables backend to create rules, including rules to isolate containers in one bridge network from containers in other bridge networks.
### Impact
The iptables rules created by Docker are removed when firewalld is reloaded using, for ex
GHSA
Moby firewalld reload makes published container ports accessible from remote hosts
ghsa·2025-07-29
CVE-2025-54388 [MEDIUM] CWE-909 Moby firewalld reload makes published container ports accessible from remote hosts
Moby firewalld reload makes published container ports accessible from remote hosts
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (dockerd), which is developed as [moby/moby](https://github.com/moby/moby) is commonly referred to as Docker, or Docker Engine.
Firewalld is a daemon used by some Linux distributions to provide a dynamically managed firewall. When Firewalld is running, Docker uses its iptables backend to create rules, including rules to isolate containers in one bridge network from containers in other bridge networks.
### Impact
The iptables rules created by Docker are removed when firewalld is reloaded using, for ex
No detection rules found.
No public exploits indexed.
2025-07-30
Published