CVE-2026-42306
published 2026-06-12CVE-2026-42306: Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version…
PriorityP337high7.2CVSS 3.1
AVLACHPRLUIRSCCNIHAH
EPSS
0.10%
0.8th percentile
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.
Affected
201 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| advanced-cluster-security | rhacs-scanner-rhel8 | — | — |
| advanced-cluster-security | rhacs-scanner-slim-rhel8 | — | — |
| ansible-automation-platform-24 | aap-must-gather-rhel8 | — | — |
| ansible-automation-platform-25 | aap-must-gather-rhel8 | — | — |
| ansible-automation-platform-26 | aap-must-gather-rhel9 | — | — |
| ansible-automation-platform-27 | aap-must-gather-rhel9 | — | — |
| ansible-automation-platform-27 | ansible-devspaces-rhel9 | — | — |
| ansible-automation-platform-tech-preview | ansible-devspaces-rhel9 | — | — |
| aquasecurity | trivy | — | — |
| assisted | agent-preinstall-image-builder-rhel9 | — | — |
| container-native-virtualization | cnv-must-gather-rhel8 | — | — |
| container-native-virtualization | cnv-must-gather-rhel9 | — | — |
| container-native-virtualization | virt-cdi-importer | — | — |
| container-native-virtualization | virt-cdi-importer-rhel9 | — | — |
| container-native-virtualization | virt-cdi-uploadserver | — | — |
| container-native-virtualization | virt-cdi-uploadserver-rhel9 | — | — |
| devspaces | traefik-rhel9 | — | — |
| devspaces | udi-base-rhel10 | — | — |
| devspaces | udi-base-rhel9 | — | — |
| devspaces | udi-rhel9 | — | — |
| docker | engine | < 29.5.1 | 29.5.1 |
| github.com | docker_docker | 0 – 28.5.2 | — |
| github.com | moby_moby | 0 – 28.5.2 | — |
| github.com | moby_moby_v2 | >= 0 < 2.0.0-beta.14 | 2.0.0-beta.14 |
| kmm | kernel-module-management-must-gather-rhel9 | — | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H
vendor_redhat7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Moby symlink (GHSA-rg2x-37c3-w2rh)
vuldb·2026-06-12·CVSS 7.2
CVE-2026-42306 [HIGH] Moby symlink (GHSA-rg2x-37c3-w2rh)
A vulnerability was found in Moby. It has been declared as critical. The affected element is an unknown function. Executing a manipulation can lead to symlink following.
The identification of this vulnerability is CVE-2026-42306. The attack can only be executed locally. There is no exploit available.
It is recommended to upgrade the affected component.
GHSA
Docker: Race condition in docker cp allows bind mount redirection to host path
ghsa·2026-05-18
CVE-2026-42306 [HIGH] CWE-367 Docker: Race condition in docker cp allows bind mount redirection to host path
Docker: Race condition in docker cp allows bind mount redirection to host path
## Summary
A race condition during `docker cp` mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service.
## Details
When copying files into a container, the daemon sets up a temporary filesystem view by bind-mounting volumes into a private mount namespace. During this setup, the mount destination is created inside the container root and then a bind mount is attached using the container-relative path resolved to an absolute host path.
Between mountpoint creation and the `mount()` syscall, a process running inside the container can replace the destination (or a parent path component) with a symlink point
Red Hat
github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup
vendor_redhat·2026-06-12·CVSS 7.2
CVE-2026-42306 [HIGH] CWE-367 github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup
github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.
A flaw was found in the Moby container framework. A race condition occurs during the `docker cp` mount setup, which a malicious container can exploit. This vulnerability allows the contai
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-42306 docker-buildx: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 docker-buildx: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 docker-buildx: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Mob
Bugzilla
CVE-2026-42306 cri-tools: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 cri-tools: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 cri-tools: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Da
Bugzilla
CVE-2026-42306 anubis: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 anubis: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 anubis: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemo
Bugzilla
CVE-2026-42306 cri-tools1.34: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 cri-tools1.34: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 cri-tools1.34: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Mob
Bugzilla
CVE-2026-42306 cri-tools1.33: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 cri-tools1.33: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 cri-tools1.33: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Mob
Bugzilla
CVE-2026-42306 buildah: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 buildah: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 buildah: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daem
Bugzilla
CVE-2026-42306 golang-github-prometheus: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 golang-github-prometheus: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 golang-github-prometheus: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.
Bugzilla
CVE-2026-42306 trivy: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 trivy: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 trivy: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon
Bugzilla
CVE-2026-42306 podman: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 podman: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 podman: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemo
Bugzilla
CVE-2026-42306 forgejo-runner: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 forgejo-runner: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 forgejo-runner: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Mo
Bugzilla
CVE-2026-42306 prometheus: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 prometheus: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 prometheus: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby D
Bugzilla
CVE-2026-42306 migrate: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 migrate: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 migrate: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daem
Bugzilla
CVE-2026-42306 prometheus: Moby container framework: Host file overwrite via race condition in docker cp mount setup [epel-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 prometheus: Moby container framework: Host file overwrite via race condition in docker cp mount setup [epel-all]
CVE-2026-42306 prometheus: Moby container framework: Host file overwrite via race condition in docker cp mount setup [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Dae
Bugzilla
CVE-2026-42306 grafana: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 grafana: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 grafana: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daem
Bugzilla
CVE-2026-42306 cri-tools1.30: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 cri-tools1.30: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 cri-tools1.30: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Mob
Bugzilla
CVE-2026-42306 cri-tools1.35: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 cri-tools1.35: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 cri-tools1.35: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Mob
Bugzilla
CVE-2026-42306 cri-tools1.32: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 cri-tools1.32: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 cri-tools1.32: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Mob
Bugzilla
CVE-2026-42306 pack: Moby container framework: Host file overwrite via race condition in docker cp mount setup [epel-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 pack: Moby container framework: Host file overwrite via race condition in docker cp mount setup [epel-all]
CVE-2026-42306 pack: Moby container framework: Host file overwrite via race condition in docker cp mount setup [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon ve
Bugzilla
CVE-2026-42306 forgejo-runner: Moby container framework: Host file overwrite via race condition in docker cp mount setup [epel-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 forgejo-runner: Moby container framework: Host file overwrite via race condition in docker cp mount setup [epel-all]
CVE-2026-42306 forgejo-runner: Moby container framework: Host file overwrite via race condition in docker cp mount setup [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby
Bugzilla
CVE-2026-42306 k9s: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 k9s: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 k9s: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon v
Bugzilla
CVE-2026-42306 jfrog-cli: Moby container framework: Host file overwrite via race condition in docker cp mount setup [epel-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 jfrog-cli: Moby container framework: Host file overwrite via race condition in docker cp mount setup [epel-all]
CVE-2026-42306 jfrog-cli: Moby container framework: Host file overwrite via race condition in docker cp mount setup [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daem
Bugzilla
CVE-2026-42306 cri-o1.32: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 cri-o1.32: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 cri-o1.32: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Da
Bugzilla
CVE-2026-42306 cri-o1.31: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 cri-o1.31: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 cri-o1.31: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Da
Bugzilla
CVE-2026-42306 opkssh: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 opkssh: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 opkssh: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemo
Bugzilla
CVE-2026-42306 cri-o1.34: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 cri-o1.34: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 cri-o1.34: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Da
Bugzilla
CVE-2026-42306 cri-tools1.31: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 cri-tools1.31: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 cri-tools1.31: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Mob
Bugzilla
CVE-2026-42306 apptainer: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 apptainer: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 apptainer: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Da
Bugzilla
CVE-2026-42306 cri-o1.35: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 cri-o1.35: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 cri-o1.35: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Da
Bugzilla
CVE-2026-42306 doctl: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 doctl: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 doctl: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon
Bugzilla
CVE-2026-42306 cri-o: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 cri-o: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 cri-o: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon
Bugzilla
CVE-2026-42306 source-to-image: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 source-to-image: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 source-to-image: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and M
Bugzilla
CVE-2026-42306 docker-compose: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 docker-compose: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 docker-compose: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Mo
Bugzilla
CVE-2026-42306 cri-tools1.36: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 cri-tools1.36: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 cri-tools1.36: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Mob
Bugzilla
CVE-2026-42306 nuclei: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 nuclei: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 nuclei: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemo
Bugzilla
CVE-2026-42306 headscale: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 headscale: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 headscale: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Da
Bugzilla
CVE-2026-42306 tailscale: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 tailscale: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 tailscale: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Da
Bugzilla
CVE-2026-42306 apptainer: Moby container framework: Host file overwrite via race condition in docker cp mount setup [epel-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 apptainer: Moby container framework: Host file overwrite via race condition in docker cp mount setup [epel-all]
CVE-2026-42306 apptainer: Moby container framework: Host file overwrite via race condition in docker cp mount setup [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daem
Bugzilla
CVE-2026-42306 nuclei: Moby container framework: Host file overwrite via race condition in docker cp mount setup [epel-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 nuclei: Moby container framework: Host file overwrite via race condition in docker cp mount setup [epel-all]
CVE-2026-42306 nuclei: Moby container framework: Host file overwrite via race condition in docker cp mount setup [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon
Bugzilla
CVE-2026-42306 cri-o1.33: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 cri-o1.33: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 cri-o1.33: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Da
Bugzilla
CVE-2026-42306 opkssh: Moby container framework: Host file overwrite via race condition in docker cp mount setup [epel-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 opkssh: Moby container framework: Host file overwrite via race condition in docker cp mount setup [epel-all]
CVE-2026-42306 opkssh: Moby container framework: Host file overwrite via race condition in docker cp mount setup [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon
Bugzilla
CVE-2026-42306 osbuild-composer: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 osbuild-composer: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 osbuild-composer: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and
Bugzilla
CVE-2026-42306 jfrog-cli: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
bugzilla·2026-07-27·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 jfrog-cli: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
CVE-2026-42306 jfrog-cli: Moby container framework: Host file overwrite via race condition in docker cp mount setup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Da
Bugzilla
CVE-2026-42306 github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup
bugzilla·2026-06-12·CVSS 7.2
CVE-2026-42306 [HIGH] CVE-2026-42306 github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup
CVE-2026-42306 github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.
2026-06-12
Published