CVE-2025-54410
published 2025-07-30CVE-2025-54410: Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other…
PriorityP424medium5.2CVSS 3.1
AVLACLPRLUINSCCLILAN
EPSS
0.15%
4.7th percentile
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. A firewalld vulnerability affects Moby releases before 28.0.0. When firewalld reloads, Docker fails to re-create iptables rules that isolate bridge networks, allowing any container to access all ports on any other container across different bridge networks on the same host. This breaks network segmentation between containers that should be isolated, creating significant risk in multi-tenant environments. Only containers in --internal networks remain protected.
Workarounds include reloading firewalld and either restarting the docker daemon, re-creating bridge networks, or using rootless mode. Maintainers anticipate a fix for this issue in version 25.0.13.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | docker.io | — | — |
| github.com | docker_docker | >= 0 < 25.0.13 | 25.0.13 |
| github.com | docker_docker | >= 0 < 25.0.13+incompatible | 25.0.13+incompatible |
| github.com | docker_docker | >= 26.0.0-rc1 < 28.0.0 | 28.0.0 |
| moby | moby | <= 25.0.12 | — |
| mobyproject | moby | < 25.0.13 | 25.0.13 |
CVSS provenance
nvdv3.15.2MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
osv5.2MEDIUM
vendor_debian3.3LOW
vendor_redhat3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
github.com/moby/moby: Moby's Firewalld reload removes bridge network isolation
vendor_redhat·2025-07-30·CVSS 3.3
CVE-2025-54410 [LOW] CWE-909 github.com/moby/moby: Moby's Firewalld reload removes bridge network isolation
github.com/moby/moby: Moby's Firewalld reload removes bridge network isolation
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. A firewalld vulnerability affects Moby releases before 28.0.0. When firewalld reloads, Docker fails to re-create iptables rules that isolate bridge networks, allowing any container to access all ports on any other container across different bridge networks on the same host. This breaks network segmentation between containers that should be isolated, creating significant risk in multi-tenant environments. Only containers in --internal networks remain protected.
Workarounds include reloading firewalld and either restarting the docker
Debian
CVE-2025-54410: docker.io - Moby is an open source container framework developed by Docker Inc. that is dist...
vendor_debian·2025·CVSS 3.3
CVE-2025-54410 [LOW] CVE-2025-54410: docker.io - Moby is an open source container framework developed by Docker Inc. that is dist...
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. A firewalld vulnerability affects Moby releases before 28.0.0. When firewalld reloads, Docker fails to re-create iptables rules that isolate bridge networks, allowing any container to access all ports on any other container across different bridge networks on the same host. This breaks network segmentation between containers that should be isolated, creating significant risk in multi-tenant environments. Only containers in --internal networks remain protected. Workarounds include reloading firewalld and either restarting the docker daemon, re-creating bridge networks, or using rootless mode. Maintainers anticip
OSV
Moby firewalld reload removes bridge network isolation in github.com/docker/docker
osv·2025-08-11
CVE-2025-54410 Moby firewalld reload removes bridge network isolation in github.com/docker/docker
Moby firewalld reload removes bridge network isolation in github.com/docker/docker
Moby firewalld reload removes bridge network isolation in github.com/docker/docker
OSV
CVE-2025-54410: Moby is an open source container framework developed by Docker Inc
osv·2025-07-30·CVSS 5.2
CVE-2025-54410 [MEDIUM] CVE-2025-54410: Moby is an open source container framework developed by Docker Inc
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. A firewalld vulnerability affects Moby releases before 28.0.0. When firewalld reloads, Docker fails to re-create iptables rules that isolate bridge networks, allowing any container to access all ports on any other container across different bridge networks on the same host. This breaks network segmentation between containers that should be isolated, creating significant risk in multi-tenant environments. Only containers in --internal networks remain protected. Workarounds include reloading firewalld and either restarting the docker daemon, re-creating bridge networks, or using rootless mode. Maintainers anticip
GHSA
Moby firewalld reload removes bridge network isolation
ghsa·2025-07-29
CVE-2025-54410 [LOW] CWE-909 Moby firewalld reload removes bridge network isolation
Moby firewalld reload removes bridge network isolation
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (dockerd), which is developed as [moby/moby](https://github.com/moby/moby) is commonly referred to as Docker, or Docker Engine.
Firewalld is a daemon used by some Linux distributions to provide a dynamically managed firewall. When Firewalld is running, Docker uses its iptables backend to create rules, including rules to isolate containers in one bridge network from containers in other bridge networks.
### Impact
The iptables rules created by Docker are removed when firewalld is reloaded using, for example "firewall-cmd --reload
OSV
Moby firewalld reload removes bridge network isolation
osv·2025-07-29
CVE-2025-54410 [LOW] Moby firewalld reload removes bridge network isolation
Moby firewalld reload removes bridge network isolation
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (dockerd), which is developed as [moby/moby](https://github.com/moby/moby) is commonly referred to as Docker, or Docker Engine.
Firewalld is a daemon used by some Linux distributions to provide a dynamically managed firewall. When Firewalld is running, Docker uses its iptables backend to create rules, including rules to isolate containers in one bridge network from containers in other bridge networks.
### Impact
The iptables rules created by Docker are removed when firewalld is reloaded using, for example "firewall-cmd --reload
No detection rules found.
No public exploits indexed.
2025-07-30
Published