CVE-2026-34040
ADVISORY - githubSummary
Summary
A security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low.
This is an incomplete fix for CVE-2024-41110.
Impact
If you don't use AuthZ plugins, you are not affected.
Using a specially-crafted API request, an attacker could make the Docker daemon forward the request to an authorization plugin without the body. The authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it.
Anyone who depends on authorization plugins that introspect the request body to make access control decisions is potentially impacted.
Workarounds
If unable to update immediately:
- Avoid using AuthZ plugins that rely on request body inspection for security decisions.
- Restrict access to the Docker API to trusted parties, following the principle of least privilege.
Credits
- 1seal / Oleh Konko (@1seal)
- Cody (c@wormhole.guru)
- Asim Viladi Oglu Manizada (@manizada)
Resources
Common Weakness Enumeration (CWE)
Authentication Bypass Using an Alternate Path or Channel
GitHub
CVSS SCORE
8.8high| Package | Type | OS Name | OS Version | Affected Ranges | Fix Versions |
|---|---|---|---|---|---|
| github.com/docker/docker | golang | - | - | <29.3.1 | 29.3.1 |
| github.com/moby/moby | golang | - | - | <29.3.1 | 29.3.1 |
| github.com/moby/moby/v2 | golang | - | - | <2.0.0-beta.8 | 2.0.0-beta.8 |
| github.com/moby/moby/v2 | golang | - | - | <0.0.0-20260325154711-f78c987ad371 | 0.0.0-20260325154711-f78c987ad371 |
CVSS:3 Severity and metrics
The CVSS metrics represent different qualitative aspects of a vulnerability that impact the overall score, as defined by the CVSS Specification.
The vulnerable component is not bound to the network stack and the attacker's path is via read/write/execute capabilities. Either: The attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document).
Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component.
The attacker requires privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.
The vulnerable system can be exploited without interaction from any user.
An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
There is a total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.
There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any or all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component.
NIST
2
CVSS SCORE
8.8highAlpine
-
Debian
-
Ubuntu
1.8
CVSS SCORE
7.8mediumGoLang
-
Amazon
-
CVSS SCORE
N/AhighChainguard
CGA-mjrp-qhw3-p2p3
-
Photon
CVE-2026-34040
-
CVSS SCORE
7.8highminimos
MINI-22q3-rh9c-7cjf
-
minimos
MINI-2549-h2f9-r5hh
-
minimos
MINI-25r7-579r-w36r
-
minimos
MINI-25vv-797r-xf2c
-
minimos
MINI-26wf-f8qg-3f4w
-
minimos
MINI-2c8g-xmfp-v2w4
-
minimos
MINI-2h72-m45q-x24c
-
minimos
MINI-2hw2-97jf-88vc
-
minimos
MINI-2p24-mxv8-hqff
-
minimos
MINI-2q4w-r44w-55g8
-
minimos
MINI-2wgg-c5qm-rr63
-
minimos
MINI-2xv3-vr8p-qc25
-
minimos
MINI-34w6-8xx6-qqrc
-
minimos
MINI-3658-3g3p-3c37
-
minimos
MINI-36w2-wr5f-xv6f
-
minimos
MINI-376g-mghh-r95r
-
minimos
MINI-39vg-f4cx-4wjw
-
minimos
MINI-3fj4-h3r6-vf2h
-
minimos
MINI-3fpc-8w77-9fx3
-
minimos
MINI-3grf-qpp4-58vq
-
minimos
MINI-42cf-h642-xcmc
-
minimos
MINI-42jv-7p84-rcjf
-
minimos
MINI-42r8-wv6g-84g3
-
minimos
MINI-43pr-xx2g-g693
-
minimos
MINI-45ww-4rc6-wm55
-
minimos
MINI-46x5-x2c2-6f27
-
minimos
MINI-48h4-63g3-8cc2
-
minimos
MINI-49wg-j732-934q
-
minimos
MINI-4c92-ggpv-gj36
-
minimos
MINI-4cc5-w2hc-wxcv
-
minimos
MINI-4ccw-vvjf-q7c7
-
minimos
MINI-4fh3-2xm8-g876
-
minimos
MINI-4g4f-w94f-w9v4
-
minimos
MINI-4gf5-vjcg-hf5g
-
minimos
MINI-4hrr-rg53-mhw5
-
minimos
MINI-4j2x-97qv-v2qf
-
minimos
MINI-4m3g-45hx-wqrh
-
minimos
MINI-4pf8-5p3m-c34j
-
minimos
MINI-4pj2-883v-chwr
-
minimos
MINI-4qfm-29rx-493j
-
minimos
MINI-4rr3-6626-999v
-
minimos
MINI-4v8m-pp75-q5m7
-
minimos
MINI-4wgv-4j3m-cqwv
-
minimos
MINI-4xq6-p2mh-rw6g
-
minimos
MINI-52jp-85wr-gxm3
-
minimos
MINI-539w-x283-j427
-
minimos
MINI-56fp-rwgf-vc7v
-
minimos
MINI-5fjg-jwf3-5823
-
minimos
MINI-5g5v-qw2x-8799
-
minimos
MINI-5grx-9vw8-fmqr
-
minimos
MINI-5h62-54jq-f3r7
-
minimos
MINI-5qr6-5h54-v5rp
-
minimos
MINI-5r52-4jfw-3x42
-
minimos
MINI-5vxw-g5hf-p3c2
-
minimos
MINI-5w3g-g877-485c
-
minimos
MINI-6587-527f-x637
-
minimos
MINI-67wq-mx5q-f4v2
-
minimos
MINI-68h7-h2cx-v3hx
-
minimos
MINI-68rg-q2wm-pxp9
-
minimos
MINI-6gxj-hw34-r5w3
-
minimos
MINI-6m66-fwj3-43qx
-
minimos
MINI-6qjf-4c49-4r54
-
minimos
MINI-6qx3-9m45-5fq7
-
minimos
MINI-72g7-f2mf-f64q
-
minimos
MINI-73pv-hxwf-q5r2
-
minimos
MINI-742r-25g5-8fvc
-
minimos
MINI-7568-cxgx-gc2q
-
minimos
MINI-766c-hxvc-w2xx
-
minimos
MINI-7727-grp8-9qmv
-
minimos
MINI-78f8-pmpw-h794
-
minimos
MINI-7cfp-wjx4-5wxr
-
minimos
MINI-7h3g-v52p-3ph3
-
minimos
MINI-7mcx-fhfw-v2c2
-
minimos
MINI-7p49-3wxh-28g5
-
minimos
MINI-7q3f-c5m6-f77f
-
minimos
MINI-7r5g-mmj2-fv69
-
minimos
MINI-7rh3-53fx-9775
-
minimos
MINI-7vfj-v7pq-wfvw
-
minimos
MINI-7x5f-7xrv-q9xj
-
minimos
MINI-7xcf-48j5-9xx4
-
minimos
MINI-8439-g24m-2x3v
-
minimos
MINI-854j-h526-2hwx
-
minimos
MINI-873v-98mq-6fpf
-
minimos
MINI-88v7-cqm8-q5c5
-
minimos
MINI-8cp3-x6gp-rx57
-
minimos
MINI-8gf3-6qq8-mj4q
-
minimos
MINI-8gg7-hcj8-jr62
-
minimos
MINI-8gp3-2j8x-fq4g
-
minimos
MINI-8mjf-r92c-9p33
-
minimos
MINI-8q5g-r94x-4mxh
-
minimos
MINI-9276-qh8j-j3hf
-
minimos
MINI-996j-6wxm-q22c
-
minimos
MINI-996r-hgp7-8g86
-
minimos
MINI-997f-wj3c-rvgp
-
minimos
MINI-99jf-h7v7-vfjv
-
minimos
MINI-99q8-fj7r-w48m
-
minimos
MINI-99vh-357g-h6j6
-
minimos
MINI-9ffv-5c4m-r4hr
-
minimos
MINI-9gx4-hgq8-wjwg
-
minimos
MINI-9h2f-wfw7-hwmj
-
minimos
MINI-9j6p-m7gw-mxvr
-
minimos
MINI-9jqx-8jjr-38wf
-
minimos
MINI-9qp9-jvxj-vjhq
-
minimos
MINI-9vch-gw6f-24cm
-
minimos
MINI-9vhh-3xvh-mj2h
-
minimos
MINI-9w53-qqqf-x665
-
minimos
MINI-9x77-494r-xmj8
-
minimos
MINI-9xqj-v9rc-q6xv
-
minimos
MINI-c228-438m-4375
-
minimos
MINI-c3qq-5jp2-q5m7
-
minimos
MINI-c45w-r6wx-9q69
-
minimos
MINI-c4mw-fg89-p234
-
minimos
MINI-c558-46fm-vhff
-
minimos
MINI-c6qg-mv33-3x3x
-
minimos
MINI-c9mj-xhw6-6j4q
-
minimos
MINI-ccc5-xh5m-ffx8
-
minimos
MINI-cccv-5h6c-7hwh
-
minimos
MINI-cf9g-jr9v-9f8x
-
minimos
MINI-cgc3-xrpc-9vjg
-
minimos
MINI-cjw4-gwc3-7v86
-
minimos
MINI-f2mm-x9v8-j3h8
-
minimos
MINI-f437-v7c2-5jr9
-
minimos
MINI-f5gm-q5g4-r56v
-
minimos
MINI-f67q-xrfv-xvf8
-
minimos
MINI-f6m8-qr3x-rj63
-
minimos
MINI-f754-gx7f-qxhx
-
minimos
MINI-f92w-jrqj-j374
-
minimos
MINI-f9pw-m22p-w64c
-
minimos
MINI-ffm2-5fwh-994q
-
minimos
MINI-fmp9-vpw6-vj9w
-
minimos
MINI-fp2v-fjpj-7gc6
-
minimos
MINI-fp57-f27g-74rr
-
minimos
MINI-fqv3-9h58-x372
-
minimos
MINI-fv3m-cwhv-45hx
-
minimos
MINI-fv3q-5882-3qj5
-
minimos
MINI-fvpc-gcqp-g5jj
-
minimos
MINI-g8vj-q5vm-223h
-
minimos
MINI-gc3c-7vh8-ww2c
-
minimos
MINI-gc69-jfh7-2j3x
-
minimos
MINI-gf9p-mm73-565f
-
minimos
MINI-ghg7-5q88-657v
-
minimos
MINI-gm7w-j52h-7424
-
minimos
MINI-gpfv-9g2w-hxhp
-
minimos
MINI-gvjf-vf5v-xj4m
-
minimos
MINI-gx6f-mpmj-6rrm
-
minimos
MINI-gxhf-93px-rf69
-
minimos
MINI-h5r2-p289-jm9j
-
minimos
MINI-h5x7-4g6g-8m24
-
minimos
MINI-h745-jrqr-hvjf
-
minimos
MINI-h8q6-q4q8-x649
-
minimos
MINI-hcvc-ch27-56ff
-
minimos
MINI-hgjh-47hp-6q46
-
minimos
MINI-hgvp-h9h4-8wcj
-
minimos
MINI-hgw2-c393-rmjw
-
minimos
MINI-hj8x-cjp9-x2hp
-
minimos
MINI-hr7r-998c-mfjq
-
minimos
MINI-hvwr-f5vj-5hh9
-
minimos
MINI-hx9g-7rfp-mf2m
-
minimos
MINI-j288-rwqr-h3v7
-
minimos
MINI-j377-x5xr-cf7m
-
minimos
MINI-j39p-h3xj-pp4c
-
minimos
MINI-j48j-wmqm-93gw
-
minimos
MINI-jfcj-x3rg-7v96
-
minimos
MINI-jggv-9v2g-9mw8
-
minimos
MINI-jhfx-cffg-w8f2
-
minimos
MINI-jjg4-2gqx-2x3v
-
minimos
MINI-jmh9-6r95-rhgx
-
minimos
MINI-jrh5-5v3h-q39v
-
minimos
MINI-jx72-75rj-cfc4
-
minimos
MINI-jx7w-f88w-92w2
-
minimos
MINI-jxr9-xr7h-r972
-
minimos
MINI-m53x-ww9p-fmc6
-
minimos
MINI-m5p6-h2rr-4h3v
-
minimos
MINI-m795-x8j9-mj2g
-
minimos
MINI-mf98-xfvq-rc55
-
minimos
MINI-mq7q-mcj6-cqc3
-
minimos
MINI-mrv9-99r2-phg4
-
minimos
MINI-mv2g-p682-mx6q
-
minimos
MINI-mvcv-xrjv-m756
-
minimos
MINI-mvg5-qhrq-3qjh
-
minimos
MINI-mvrj-39q8-gmq3
-
minimos
MINI-p25q-5848-99m3
-
minimos
MINI-p3m4-vqv8-qqw7
-
minimos
MINI-p4c9-p679-w42v
-
minimos
MINI-p6pm-7gm8-hjxc
-
minimos
MINI-p7qm-674m-rjch
-
minimos
MINI-p7r6-9hch-vr8x
-
minimos
MINI-p8w5-ch2m-9q2f
-
minimos
MINI-p959-hcpj-x8wx
-
minimos
MINI-pf9m-w6hg-9m75
-
minimos
MINI-pg67-wwq6-3cqf
-
minimos
MINI-pgjq-3r28-fxq8
-
minimos
MINI-pj75-xf4m-92v9
-
minimos
MINI-pjq3-22v4-247r
-
minimos
MINI-pmmw-chxx-vcgq
-
minimos
MINI-pvpv-3xq6-45cw
-
minimos
MINI-pvqp-wmrc-86x7
-
minimos
MINI-px45-xxhx-3hq8
-
minimos
MINI-pxr5-9j33-q5jw
-
minimos
MINI-q8qc-xj6p-7qqw
-
minimos
MINI-q9fg-56gq-fh37
-
minimos
MINI-qc2h-2hmr-fpv2
-
minimos
MINI-qjjv-qwwg-wq6m
-
minimos
MINI-qm88-cwg9-68vf
-
minimos
MINI-qx33-rprj-6w6g
-
minimos
MINI-qx8w-6frj-85v3
-
minimos
MINI-r227-28ch-56qv
-
minimos
MINI-r2g4-r6f8-f5fc
-
minimos
MINI-r2mp-6744-jmvh
-
minimos
MINI-r553-7wc7-3xrj
-
minimos
MINI-r5h9-6vj9-m4p8
-
minimos
MINI-r626-m5q6-r3j8
-
minimos
MINI-r6gp-xhq9-vrqw
-
minimos
MINI-r74c-f3w2-r36r
-
minimos
MINI-r843-whhf-78fc
-
minimos
MINI-rc7c-f928-895p
-
minimos
MINI-rf68-crmf-9j9x
-
minimos
MINI-rg73-6f5r-q69h
-
minimos
MINI-rg7c-4j65-xfcw
-
minimos
MINI-rg7m-h267-6g9q
-
minimos
MINI-rj3f-r8ff-3vj2
-
minimos
MINI-rrc2-3vm2-836j
-
minimos
MINI-rvpv-wxr8-gh98
-
minimos
MINI-rwq7-42gh-mg7x
-
minimos
MINI-v59g-gm7c-4g5g
-
minimos
MINI-vcm7-fx9w-fwgw
-
minimos
MINI-vmpm-h888-7qph
-
minimos
MINI-vp5x-8gvq-phpf
-
minimos
MINI-vpjp-xw7q-3j4f
-
minimos
MINI-vqx9-cjr2-72rq
-
minimos
MINI-w25r-5g59-4rwq
-
minimos
MINI-w2jv-49hm-f438
-
minimos
MINI-w7xp-6jw3-wgw4
-
minimos
MINI-w83r-vrhj-q7c9
-
minimos
MINI-wc88-49pc-9p7v
-
minimos
MINI-wc8q-gq83-x84c
-
minimos
MINI-wjcf-822m-pm3v
-
minimos
MINI-wq5w-mrxh-2xjm
-
minimos
MINI-wrm3-mxhm-wm53
-
minimos
MINI-wrx8-r384-mj47
-
minimos
MINI-wwhw-gmxg-47x9
-
minimos
MINI-x22m-rgv4-p4c4
-
minimos
MINI-x23q-fxhm-6m85
-
minimos
MINI-x4h8-rxrm-mpcq
-
minimos
MINI-x5xj-h5x5-8rq4
-
minimos
MINI-x7cc-5xwv-828g
-
minimos
MINI-x823-pq3v-2rpm
-
minimos
MINI-x85v-3w4j-6jmx
-
minimos
MINI-x87f-9597-gjx6
-
minimos
MINI-x8mj-xvvf-8mvp
-
minimos
MINI-xfw3-x3jq-gw97
-
minimos
MINI-xg9w-xr93-m37g
-
minimos
MINI-xqg7-rgxg-ff4v
-
minimos
MINI-xqp7-5ccv-rvx5
-