CVE-2026-42306
ADVISORY - githubSummary
Summary
A race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service.
Details
When copying files into a container, the daemon sets up a temporary filesystem view by bind-mounting volumes into a private mount namespace. During this setup, the mount destination is created inside the container root and then a bind mount is attached using the container-relative path resolved to an absolute host path.
Between mountpoint creation and the mount() syscall, a process running inside the container can replace the destination (or a parent path component) with a symlink pointing to an arbitrary location on the host. The mount() syscall follows the symlink, causing the volume to be bind-mounted onto an arbitrary host path instead of the intended container path.
Impact
A malicious container can redirect a volume bind mount to an arbitrary host path. The impact depends on the volume content and mount options:
- If the volume is writable, arbitrary host files at the redirected path could be overwritten with the volume's contents.
- If the volume is read-only, the host path is masked by the mount for the duration of the operation, causing denial of service.
- In all cases the mount is temporary (torn down after the
docker cpcompletes), but the effects of any writes persist.
Conditions for exploitation
- A container must have at least one volume mount.
- A process inside the container must be able to rapidly create and swap symlinks at the volume mount destination path.
- An operator must initiate a
docker cpinto that container, or call thePUT /containers/{id}/archiveorHEAD /containers/{id}/archiveAPI endpoints.
Not affected
- Containers that do not have volume mounts are not affected, as the race occurs during volume bind-mount setup.
Workarounds
- Only run containers from trusted images.
- Avoid using
docker cpwith untrusted running containers. - Use authorization plugins to restrict access to the archive API endpoints (
PUT /containers/{id}/archive,HEAD /containers/{id}/archive).
NIST
CVSS SCORE
7.2highGitHub
CVSS SCORE
7.2highDebian
-
Ubuntu
0.8
CVSS SCORE
7.2mediumGoLang
-
Amazon
-
CVSS SCORE
N/AhighChainguard
CGA-cjw6-g67q-rwx9
-
minimos
MINI-24pc-4636-vq22
-
minimos
MINI-253q-6qr7-c6cg
-
minimos
MINI-2v77-4mc5-w7m3
-
minimos
MINI-2vrg-4wvm-573p
-
minimos
MINI-3g54-4vqw-3j6w
-
minimos
MINI-3mr4-mpm8-prjq
-
minimos
MINI-3pcf-7pgm-rpxf
-
minimos
MINI-3v42-3863-c3hh
-
minimos
MINI-3vq4-ppgj-6hc2
-
minimos
MINI-3vwh-vm32-8c38
-
minimos
MINI-46v5-mfp4-ch45
-
minimos
MINI-4787-hhqx-fmhq
-
minimos
MINI-4gq5-2chh-wxpr
-
minimos
MINI-4hx2-23wp-49x6
-
minimos
MINI-4jqw-rvq9-x2cr
-
minimos
MINI-552m-vj9v-rfj8
-
minimos
MINI-56gg-6vmq-mxvh
-
minimos
MINI-57rw-mvxq-p7jh
-
minimos
MINI-5f75-p49h-hfjp
-
minimos
MINI-5fjj-9cvv-m82f
-
minimos
MINI-5gfq-4xgh-jjc8
-
minimos
MINI-5gh6-cqjw-j73m
-
minimos
MINI-5h35-fr7v-3p8x
-
minimos
MINI-5h57-r6pv-9g3p
-
minimos
MINI-5v8v-7h8v-h65c
-
minimos
MINI-5wq6-vpq5-9gqh
-
minimos
MINI-5xw5-p9m2-3pqf
-
minimos
MINI-62q5-vc7h-qjr9
-
minimos
MINI-656c-pjjw-gv2p
-
minimos
MINI-65vg-p5wr-xx37
-
minimos
MINI-66mf-rmpg-jfhf
-
minimos
MINI-675p-wc3j-v698
-
minimos
MINI-68cp-q9fr-vfh7
-
minimos
MINI-68hf-w9f5-jjgq
-
minimos
MINI-6hhj-9xcf-cgcf
-
minimos
MINI-6m33-p384-gw8q
-
minimos
MINI-6m8g-85rw-qm7c
-
minimos
MINI-6pmh-8352-5w7r
-
minimos
MINI-6q35-fq5r-mm36
-
minimos
MINI-6qm9-m8jr-m4mh
-
minimos
MINI-6rvx-3hc9-2925
-
minimos
MINI-74jw-4v9v-m2gv
-
minimos
MINI-76v5-9wwx-fh64
-
minimos
MINI-776q-4x86-37x5
-
minimos
MINI-789q-xrr9-px5f
-
minimos
MINI-7cg3-5w72-vvf5
-
minimos
MINI-7fpc-x5f3-jw4h
-
minimos
MINI-7gp3-qqcx-h7w2
-
minimos
MINI-7p5j-74h3-xqj6
-
minimos
MINI-7rhx-9jg5-4w84
-
minimos
MINI-8666-f4vg-mf3f
-
minimos
MINI-87gw-jmf6-cpjq
-
minimos
MINI-88xq-3p8p-6mhx
-
minimos
MINI-89f9-vj89-x97v
-
minimos
MINI-89m6-69qq-wvv5
-
minimos
MINI-8ggq-95h2-65rp
-
minimos
MINI-8hf2-9p55-75wr
-
minimos
MINI-8m5x-rmg2-5qmc
-
minimos
MINI-8m6p-c9rv-wpjc
-
minimos
MINI-8pr7-p667-wp38
-
minimos
MINI-8qq3-xr9p-m5cc
-
minimos
MINI-8qxh-hmvw-xhww
-
minimos
MINI-9276-78f4-73qx
-
minimos
MINI-92wj-mjq5-r2hh
-
minimos
MINI-92xc-h5q7-qf99
-
minimos
MINI-932h-f4qj-7638
-
minimos
MINI-98hg-69r9-hw3f
-
minimos
MINI-99mg-g6r9-jwx5
-
minimos
MINI-9c29-3p7m-6rc6
-
minimos
MINI-9f8r-gmg9-368p
-
minimos
MINI-9h8h-v3pm-jv27
-
minimos
MINI-9jv9-g3jg-r8xr
-
minimos
MINI-9pc3-hjvv-jwch
-
minimos
MINI-9vx4-j9ww-6vvg
-
minimos
MINI-9w84-7qx3-x4w2
-
minimos
MINI-9w8v-79rj-2qm5
-
minimos
MINI-c45p-8h9r-q7vf
-
minimos
MINI-c7q6-9rfh-8366
-
minimos
MINI-cc95-c348-9h7q
-
minimos
MINI-cp43-crq6-62c2
-
minimos
MINI-cw55-q8mc-35mx
-
minimos
MINI-cxc9-559m-pmxg
-
minimos
MINI-cxhw-hjh4-3mxw
-
minimos
MINI-f27q-crm3-mf7g
-
minimos
MINI-f3jw-cxwr-88r2
-
minimos
MINI-f776-342p-hvqx
-
minimos
MINI-f79f-w77h-v668
-
minimos
MINI-f87v-vgpp-9mpv
-
minimos
MINI-f89x-9xc4-xcr5
-
minimos
MINI-f97x-gr4j-c336
-
minimos
MINI-fc4c-fg5v-xf28
-
minimos
MINI-fcw6-pr3p-22wq
-
minimos
MINI-ff2q-4q34-vwqc
-
minimos
MINI-ff7q-8366-rrpp
-
minimos
MINI-fw3j-3fhm-7f7v
-
minimos
MINI-fwvf-p5qf-rx26
-
minimos
MINI-g4hm-h6pj-rf36
-
minimos
MINI-g649-3j56-x22m
-
minimos
MINI-g8p4-p92q-q3j8
-
minimos
MINI-g93j-r85h-4jgf
-
minimos
MINI-gwv6-q53v-6x86
-
minimos
MINI-h34f-vcrq-58xw
-
minimos
MINI-h42h-p2jv-ffrw
-
minimos
MINI-h4gx-wx25-493x
-
minimos
MINI-h5p3-7fqc-c3h3
-
minimos
MINI-h896-96xc-hwpf
-
minimos
MINI-hffp-f4hr-mfvf
-
minimos
MINI-hjxq-7prg-8fjx
-
minimos
MINI-hpqj-j56m-rrm4
-
minimos
MINI-j6q9-3737-w492
-
minimos
MINI-j75m-3f8v-85f7
-
minimos
MINI-j7j6-hp54-w9x8
-
minimos
MINI-jc37-3mf9-c928
-
minimos
MINI-jcxw-5889-c56j
-
minimos
MINI-jfhq-q8w7-8rv2
-
minimos
MINI-jg79-hhc5-w26g
-
minimos
MINI-jggw-64pc-wc6m
-
minimos
MINI-jhjv-m2gv-6p39
-
minimos
MINI-jpw8-xxmf-h362
-
minimos
MINI-jrv3-x2mv-4ghx
-
minimos
MINI-jw6f-g3g2-wxjq
-
minimos
MINI-jwm6-x999-vj2h
-
minimos
MINI-m2gp-fw32-w9g9
-
minimos
MINI-m8gf-7635-w9vp
-
minimos
MINI-mwc9-4r77-8xcw
-
minimos
MINI-mxf9-8qwc-chq5
-
minimos
MINI-p28v-8x9f-3wg9
-
minimos
MINI-p2cf-83mp-m24c
-
minimos
MINI-p2xq-xrcf-5g5f
-
minimos
MINI-p49v-x2vw-fxph
-
minimos
MINI-p4mc-v438-gwm3
-
minimos
MINI-p8cc-hg3h-c2q6
-
minimos
MINI-p939-h87w-q6qf
-
minimos
MINI-pmmj-v3fq-qjp5
-
minimos
MINI-pr3x-g64q-pv7v
-
minimos
MINI-prxf-5m7p-2928
-
minimos
MINI-pw8g-qprm-9wf2
-
minimos
MINI-pxf4-w8c4-27cf
-
minimos
MINI-q3rv-2hq4-h5hv
-
minimos
MINI-q6j8-fhw2-cx96
-
minimos
MINI-q7mf-c3x7-xhf7
-
minimos
MINI-q82h-g6m4-7r85
-
minimos
MINI-q9xq-pj4v-cc6x
-
minimos
MINI-qjr7-5mch-fg4r
-
minimos
MINI-qqr8-7983-644h
-
minimos
MINI-qvf9-v936-rm84
-
minimos
MINI-qxvf-rprg-mr5c
-
minimos
MINI-r255-4rhw-6qp5
-
minimos
MINI-r297-9r3c-mpxp
-
minimos
MINI-rc26-68mj-wg8q
-
minimos
MINI-rmg4-929m-33rq
-
minimos
MINI-rmq5-697q-xmc6
-
minimos
MINI-rrxv-3rj4-2786
-
minimos
MINI-rv35-5c5p-34w2
-
minimos
MINI-rv64-pv2w-mq6f
-
minimos
MINI-rw2f-v863-85ff
-
minimos
MINI-v552-8vvr-f338
-
minimos
MINI-v622-6wc7-545w
-
minimos
MINI-v638-52v2-599h
-
minimos
MINI-v6c8-8vhg-gqqr
-
minimos
MINI-v794-xjq7-r368
-
minimos
MINI-v86c-j6vj-g38x
-
minimos
MINI-v9jg-mwwg-h2fj
-
minimos
MINI-vc2c-w43j-62qh
-
minimos
MINI-vjgh-ccmv-x5p3
-
minimos
MINI-vx22-8wjx-pm6c
-
minimos
MINI-vxp5-876w-2gjv
-
minimos
MINI-w3q2-g73w-gqgw
-
minimos
MINI-w66r-p4pp-9vc6
-
minimos
MINI-w6xx-rpg2-gw6w
-
minimos
MINI-wf2q-f9jx-r869
-
minimos
MINI-wj3x-98m9-974p
-
minimos
MINI-wjpv-pr6v-6449
-
minimos
MINI-wm29-gw24-94q4
-
minimos
MINI-wq3g-55vx-jpxg
-
minimos
MINI-wrr7-745h-cjfh
-
minimos
MINI-ww6x-g4vx-c7wc
-
minimos
MINI-wwvj-f42x-w96m
-
minimos
MINI-x64f-qg4m-hhhr
-
minimos
MINI-x8g7-2gxc-5w9w
-
minimos
MINI-x9r6-g397-73qq
-
minimos
MINI-xcq8-jwgr-39gx
-
minimos
MINI-xf7g-5xv9-f5g7
-
minimos
MINI-xf8r-jw5q-74r9
-
minimos
MINI-xfmc-2pvr-342r
-
minimos
MINI-xj6p-2f2q-cx6q
-
minimos
MINI-xjgm-9929-98v5
-
minimos
MINI-xjpv-6m3m-x62x
-
minimos
MINI-xqxr-8wx6-w7g7
-
minimos
MINI-xw25-vjgg-pxcv
-
minimos
MINI-xx5f-hghm-r39w
-