« Back to list

CVE-2026-92542

Status: Awaiting AnalysisMedium (6.9)—

The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encrypted with the overlay-network IPsec parameters which meets the following criteria:

- UDP datagram - Destination port is the Swarm data-path port - Datagram starts with a VXLAN header for the VNI of an encrypted overlay network which any running container on the node is connected to

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Vulnerabilidad local (AV:L/PR:L) que permite a procesos sin privilegios en el espacio de nombres del host interceptar y falsificar datagramas VXLAN para eludir cifrado IPsec, logrando man-in-the-middle en redes superpuestas de Docker Swarm. VI:H/VA:H confirma impacto de integridad y disponibilidad e

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Network SegmentationEncrypt Sensitive InformationUser TrainingUser Account ManagementThreat Intelligence ProgramNetwork Intrusion Prevention

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-92542",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-92542",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-07T20:30:27.853237Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security@docker.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6.9,
          "Automatable": "NOT_DEFINED",
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security@docker.com",
      "affectedData": [
        {
          "vendor": "Docker",
          "product": "Docker Engine",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "25.0.19",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "26.0.0",
              "lessThan": "29.8.2",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Docker",
          "product": "Docker Engine overlay network driver",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "v25.0.19",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "v26.0.0",
              "lessThan": "*",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "packageName": "github.com/docker/docker/libnetwork/drivers/overlay",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Moby",
          "product": "Moby overlay network driver",
          "versions": [
            {
              "status": "affected",
              "version": "v2.0.0-beta.0",
              "lessThan": "v2.0.0-beta.25",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "packageName": "github.com/moby/moby/v2/daemon/libnetwork/drivers/overlay",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-07T17:17:02.580",
  "references": [
    {
      "url": "https://github.com/moby/moby/security/advisories/GHSA-6m9p-4h64-m6vh",
      "source": "security@docker.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encrypted with the overlay-network IPsec parameters which meets the following criteria:\n\n- UDP datagram\n- Destination port is the Swarm data-path port\n- Datagram starts with a VXLAN header for the VNI of an encrypted overlay network which any running container on the node is connected to"
    }
  ],
  "lastModified": "2026-10-08T20:46:35.260",
  "sourceIdentifier": "security@docker.com"
}