« Back to list

CVE-2026-42306

Status: AnalyzedHigh (7.2)—

Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Requiere interacción del usuario (UI:R) para ejecutar docker cp con contenedor malicioso. Impactos: manipulación de archivos del host (sobrescritura) e interrupciones de servicio (DoS) por redireccionamiento de mount.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Restrict File and Directory PermissionsRemote Data StorageFilter Network TrafficEncrypt Sensitive InformationApplication Isolation and SandboxingExploit Protection

Affected technologies (3)

Docker — EngineMobyproject — MobyMobyproject — Moby/v2

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-42306",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42306",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-13T03:25:35.429147Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 0.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 0.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "moby",
          "product": "moby",
          "versions": [
            {
              "status": "affected",
              "version": "github.com/docker/docker/daemon <= 28.5.2"
            },
            {
              "status": "affected",
              "version": "Docker Engine < 29.5.1"
            },
            {
              "status": "affected",
              "version": "github.com/moby/moby/v2/daemon < 2.0.0-beta.14"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-12T19:16:27.490",
  "references": [
    {
      "url": "https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-61"
        },
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14."
    }
  ],
  "lastModified": "2026-06-17T10:47:39.960",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:docker:engine:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0387267D-1C09-445D-8DE5-EBF7ED5D8DA7",
              "versionEndExcluding": "29.5.1"
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13145CF0-6F92-4618-9D3B-7CC2BF2093AD",
              "versionEndIncluding": "28.5.2"
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "41E96E86-7594-4167-B07C-88D160E55342"
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A64F5FE0-916E-4204-ABEE-1F7A35318411"
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6BDD2BEB-8FED-445D-917C-20032175523D"
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2EB749A6-2846-416F-8F34-B9E367CB339B"
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62AB7D16-0C2C-4C2C-883E-FDCE44BFCF7E"
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta13:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D87928A4-5851-4FEC-8623-E156967B2BB8"
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "96A4B37B-E3A1-495F-A9CD-FB64450A3C4C"
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "197109A1-5D87-4A71-B533-D4C290471B77"
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C92B17E7-7C0C-437E-8CE7-D8D110992196"
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3A71A9E-CEBB-4494-B5AF-A22B4AC59240"
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A7D288EB-1234-45BC-877C-52424291A8CD"
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "42DE84CD-889E-4EBE-B23E-D7774DF2DFDF"
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71BE8BC1-B8CF-4390-B743-F9415BF45C01"
            },
            {
              "criteria": "cpe:2.3:a:mobyproject:moby\\/v2:2.0.0:beta9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB767A77-2F36-49D6-8DD6-C66000BA59CC"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}