CVE-2026-33997
ADVISORY - githubSummary
Summary
A security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user.
Plugins that request exactly one privilege are also affected, because no comparison is performed at all.
Impact
If plugins are not in use, there is no impact.
When a plugin is installed, the daemon computes the privileges required by the plugin's configuration and compares them with the privileges approved during installation. A malicious plugin can exploit this bug so that the daemon accepts privileges that differ from what was intended to be approved.
Anyone who depends on the plugin installation approval flow as a meaningful security boundary is potentially impacted.
Depending on the privilege set involved, this may include highly sensitive plugin permissions such as broad device access.
For consideration: exploitation still requires a plugin to be installed from a malicious source, and Docker plugins are relatively uncommon. Docker Desktop also does not support plugins.
Workarounds
If unable to update immediately:
- Do not install plugins from untrusted sources
- Carefully review all privileges requested during
docker plugin install - Restrict access to the Docker daemon to trusted parties, following the principle of least privilege
- Avoid relying on plugin privilege approval as the only control boundary for sensitive environments
Credits
- Reported by Cody (c@wormhole.guru, PGP 0x9FA5B73E)
Common Weakness Enumeration (CWE)
Off-by-one Error
Incorrect Privilege Assignment
GitHub
1.6
CVSS SCORE
6.8medium| Package | Type | OS Name | OS Version | Affected Ranges | Fix Versions |
|---|---|---|---|---|---|
| github.com/docker/docker | golang | - | - | <29.3.1 | Not yet available |
| github.com/moby/moby | golang | - | - | <29.3.1 | Not yet available |
| github.com/moby/moby/v2 | golang | - | - | <2.0.0-beta.8 | 2.0.0-beta.8 |
| github.com/moby/moby/v2 | golang | - | - | <0.0.0-20260325154711-f78c987ad371 | 0.0.0-20260325154711-f78c987ad371 |
CVSS:3 Severity and metrics
The CVSS metrics represent different qualitative aspects of a vulnerability that impact the overall score, as defined by the CVSS Specification.
The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared physical (e.g., Bluetooth or IEEE 802.11) or logical (e.g., local IP subnet) network, or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN to an administrative network zone). One example of an Adjacent attack would be an ARP (IPv4) or neighbor discovery (IPv6) flood leading to a denial of service on the local LAN segment (e.g., CVE-2013-6014).
A successful attack depends on conditions beyond the attacker's control, requiring investing a measurable amount of effort in research, preparation, or execution against the vulnerable component before a successful attack.
The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited. For example, a successful exploit may only be possible during the installation of an application by a system administrator.
An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
There is a total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.
There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any or all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
There is no impact to availability within the impacted component.
NIST
CVSS SCORE
6.8mediumAlpine
-
Debian
-
Ubuntu
2.8
CVSS SCORE
8.1mediumGoLang
-
Amazon
-
CVSS SCORE
N/AmediumRed Hat
1.7
CVSS SCORE
8.4highChainguard
CGA-2mw7-9wj3-5pxp
-
Photon
CVE-2026-33997
-
CVSS SCORE
8.1highminimos
MINI-229r-j462-96x8
-
minimos
MINI-25j2-9cp3-43f7
-
minimos
MINI-27hm-8whj-4v2p
-
minimos
MINI-2hvr-84gr-xm5c
-
minimos
MINI-2jmh-rpm2-chh8
-
minimos
MINI-2q79-h6hw-fwq5
-
minimos
MINI-2r4q-mpq4-3c2g
-
minimos
MINI-32pv-89rj-2cj9
-
minimos
MINI-34w3-p3xr-mqj3
-
minimos
MINI-35p8-vxqx-r58h
-
minimos
MINI-39c9-96fw-wrr9
-
minimos
MINI-3c7h-59pc-32mh
-
minimos
MINI-3fh9-42fg-2h4g
-
minimos
MINI-3fq4-5wxj-2823
-
minimos
MINI-3h38-424w-475g
-
minimos
MINI-3j3x-fgrq-9qh8
-
minimos
MINI-3m3c-2phr-3vp8
-
minimos
MINI-4296-m74m-rgjp
-
minimos
MINI-4f53-86gc-wgpx
-
minimos
MINI-4h2r-4r68-fgm8
-
minimos
MINI-4m7v-xv77-4jv7
-
minimos
MINI-4p82-5h4h-q765
-
minimos
MINI-4q78-mrqg-82h5
-
minimos
MINI-4q8c-q4vw-3888
-
minimos
MINI-4qvv-4vj4-hr39
-
minimos
MINI-4qvw-9w62-5m3m
-
minimos
MINI-4r46-r5f3-62xh
-
minimos
MINI-4vxg-h63r-j25r
-
minimos
MINI-4wcq-5fv7-hh88
-
minimos
MINI-4x5w-f66w-x562
-
minimos
MINI-4xf9-9wxc-3q43
-
minimos
MINI-53wf-92g5-6pfm
-
minimos
MINI-556j-x46m-7257
-
minimos
MINI-5955-2qqf-66fm
-
minimos
MINI-59h6-gf86-46w7
-
minimos
MINI-5qxr-ppx5-cf3r
-
minimos
MINI-5rmq-v7q4-47j9
-
minimos
MINI-5wf8-94qf-pqp6
-
minimos
MINI-5wv6-hwjh-9cx9
-
minimos
MINI-5xm9-f5x2-m6hc
-
minimos
MINI-63j2-4h78-wgv6
-
minimos
MINI-6435-5x73-mhq8
-
minimos
MINI-644w-28f6-pcxc
-
minimos
MINI-65cx-f3qr-xc66
-
minimos
MINI-65vh-c4cq-g4cj
-
minimos
MINI-668x-463x-69jm
-
minimos
MINI-672m-7cvw-mrq8
-
minimos
MINI-692h-5f36-gq7f
-
minimos
MINI-69g3-m52c-jf4m
-
minimos
MINI-6p57-9r27-9359
-
minimos
MINI-6qj6-9w8g-m4x6
-
minimos
MINI-6rgw-xfr5-gcgx
-
minimos
MINI-6wqr-7jgq-9pmm
-
minimos
MINI-7592-ppmj-277p
-
minimos
MINI-76vj-5jgr-w828
-
minimos
MINI-7ff5-g79x-hmhr
-
minimos
MINI-7j4p-q33m-9vx4
-
minimos
MINI-7jhc-vr42-q8g7
-
minimos
MINI-7p5j-wx47-xxm7
-
minimos
MINI-7vm8-fg8x-q8p3
-
minimos
MINI-82j3-jj8x-rmm3
-
minimos
MINI-842m-g6cj-wvfj
-
minimos
MINI-863f-5h2g-f473
-
minimos
MINI-875f-97vw-q8gm
-
minimos
MINI-8h3w-9wj4-mg94
-
minimos
MINI-8hhx-x3xw-hw2p
-
minimos
MINI-8hpr-38c7-f3pg
-
minimos
MINI-8jw5-q57v-jjj9
-
minimos
MINI-8m7m-hfhc-v5pr
-
minimos
MINI-8rpp-r37v-pr6v
-
minimos
MINI-8w92-3cp9-wppm
-
minimos
MINI-9987-vx9q-x296
-
minimos
MINI-9fpc-8m6m-37j3
-
minimos
MINI-9pp6-7xjv-wjj8
-
minimos
MINI-9qmw-v97g-c5pp
-
minimos
MINI-9rh6-g628-rqh9
-
minimos
MINI-9wq7-vhr9-22xc
-
minimos
MINI-c53w-6j3p-cw77
-
minimos
MINI-c649-pqr2-mxvr
-
minimos
MINI-c8fm-8cvv-hwrv
-
minimos
MINI-c8g9-253g-qh3v
-
minimos
MINI-ccpx-rp49-w52x
-
minimos
MINI-ccx7-rjh2-g5gv
-
minimos
MINI-cmhm-7mxv-vr4w
-
minimos
MINI-cphg-pq36-qwm3
-
minimos
MINI-cvm7-r4m5-r5c3
-
minimos
MINI-cwwv-8c22-4pfc
-
minimos
MINI-f244-m29x-j644
-
minimos
MINI-f3p3-8wjh-x22x
-
minimos
MINI-f55p-47qm-jvrc
-
minimos
MINI-f5j2-w63v-vv86
-
minimos
MINI-fh78-rx3r-9mfw
-
minimos
MINI-fqcf-xqf6-p32c
-
minimos
MINI-fqwf-jjg2-fqrr
-
minimos
MINI-fxg3-c6h5-jg27
-
minimos
MINI-g393-ghg5-2239
-
minimos
MINI-g4m9-wq59-wqx4
-
minimos
MINI-g78f-3227-m7rq
-
minimos
MINI-g9c6-7g6w-7x9g
-
minimos
MINI-g9q4-85xf-7vg9
-
minimos
MINI-gf8q-6839-jmmm
-
minimos
MINI-gffm-8rjc-44c3
-
minimos
MINI-gg86-222f-9fmw
-
minimos
MINI-ggmf-86q2-p995
-
minimos
MINI-gjm5-5wfh-p7wf
-
minimos
MINI-h38c-wv35-cjf6
-
minimos
MINI-h479-5hf8-v926
-
minimos
MINI-h4fc-8q5p-3q49
-
minimos
MINI-h668-6v33-w8xj
-
minimos
MINI-h9rw-g7r3-wx6c
-
minimos
MINI-hjw2-5mhf-839c
-
minimos
MINI-hv2q-pv72-jx2v
-
minimos
MINI-hx7f-wh59-6gh5
-
minimos
MINI-hxrr-3c75-v2vp
-
minimos
MINI-j2q2-7gv2-2555
-
minimos
MINI-j3q4-7799-22r7
-
minimos
MINI-j675-7897-qxwc
-
minimos
MINI-j79q-wrxm-9hc8
-
minimos
MINI-jjrp-w9fm-64wm
-
minimos
MINI-jp52-35v4-h8p2
-
minimos
MINI-jpf6-v29v-362g
-
minimos
MINI-jqgh-cfc3-q23r
-
minimos
MINI-jqjf-7pjg-54vp
-
minimos
MINI-jr32-64gx-3gvh
-
minimos
MINI-jv3f-c5gh-wr67
-
minimos
MINI-jwpv-wqm9-xqwp
-
minimos
MINI-jwwh-cf34-3vvx
-
minimos
MINI-m2fc-c28h-vhj3
-
minimos
MINI-m2g4-wpjv-rq72
-
minimos
MINI-m4g8-7fjm-rff3
-
minimos
MINI-m73q-j667-mcwj
-
minimos
MINI-m763-j76g-p55c
-
minimos
MINI-m7vm-qrx4-xcgw
-
minimos
MINI-m8x7-9wwm-mqxq
-
minimos
MINI-m958-6cj9-28v3
-
minimos
MINI-mgpf-m8wm-h7g7
-
minimos
MINI-mh6j-4vwm-69mc
-
minimos
MINI-mmj2-rxqm-8pfq
-
minimos
MINI-mq47-gcw8-qf5w
-
minimos
MINI-mqp5-7m8g-3mjp
-
minimos
MINI-mvv9-929p-v4w8
-
minimos
MINI-p245-rvvj-v9qp
-
minimos
MINI-p2jw-wr25-fpx3
-
minimos
MINI-pc3w-7r49-vfch
-
minimos
MINI-pcrc-8qm9-2xh3
-
minimos
MINI-phgv-4j72-5w37
-
minimos
MINI-prfm-9qv7-vp8p
-
minimos
MINI-pv3g-cpwh-24r9
-
minimos
MINI-px23-5vrm-r7fj
-
minimos
MINI-q3mj-c292-gx77
-
minimos
MINI-q3vx-x576-mchg
-
minimos
MINI-q72r-2w28-w2mj
-
minimos
MINI-q8mh-gxcv-jpmh
-
minimos
MINI-qc4v-p4fw-2vh9
-
minimos
MINI-qfgf-v2xg-h94c
-
minimos
MINI-qm45-8g6v-737q
-
minimos
MINI-qr5h-6jxq-gpxw
-
minimos
MINI-qvrv-76r4-2x4q
-
minimos
MINI-r538-xr93-fccf
-
minimos
MINI-r5f3-fffc-2vgc
-
minimos
MINI-r88w-g357-hw8c
-
minimos
MINI-rcgf-3w5w-wp7j
-
minimos
MINI-rfpj-24ch-g8vp
-
minimos
MINI-rjwj-jh7v-hm6f
-
minimos
MINI-rmf3-gh9v-rvpj
-
minimos
MINI-rmgm-w2rc-9chp
-
minimos
MINI-rppm-fv7h-33gf
-
minimos
MINI-rpxx-xw8p-xr67
-
minimos
MINI-rr32-8pg9-63cf
-
minimos
MINI-rr8r-h4g7-f9v7
-
minimos
MINI-rv47-gmrj-xj48
-
minimos
MINI-rw34-fqj2-mhr6
-
minimos
MINI-rwjg-3wqf-xw72
-
minimos
MINI-rx57-9963-vmm7
-
minimos
MINI-v6j6-79r3-chj3
-
minimos
MINI-v8m6-pmhx-f5j6
-
minimos
MINI-vj5m-vcvw-7rj6
-
minimos
MINI-vm6f-7w29-pgjq
-
minimos
MINI-vmmw-xxc7-73hw
-
minimos
MINI-vpqg-v7fr-hg2r
-
minimos
MINI-vq33-759c-r52g
-
minimos
MINI-vxw2-98rg-32wm
-
minimos
MINI-w2m5-h83p-g24f
-
minimos
MINI-w38m-6fwg-6jh3
-
minimos
MINI-w823-j9vq-www8
-
minimos
MINI-wcq5-fqf7-mvx5
-
minimos
MINI-wf8f-5jwm-vwxp
-
minimos
MINI-wmhg-g82v-hpvx
-
minimos
MINI-wrvp-g5h2-p2rp
-
minimos
MINI-ww9j-mwpc-5cw9
-
minimos
MINI-x5vr-qgpp-pfr5
-
minimos
MINI-x7x4-85mh-w2cw
-
minimos
MINI-xfj6-prx5-5xj9
-
minimos
MINI-xg64-6mhv-rcq2
-
minimos
MINI-xgpj-c4f6-5qcc
-
minimos
MINI-xpvr-g898-2m9p
-
minimos
MINI-xvr3-x7mf-h43x
-