CVE-2026-41567
ADVISORY - githubSummary
Summary
When a user uploads a compressed archive into a container, a malicious image can execute arbitrary code with daemon (host root) privileges.
Details
When handling PUT /containers/{id}/archive requests with compressed archives, the daemon decompresses them using external system binaries. Due to incorrect ordering of operations, these binaries are resolved from the container's filesystem rather than the host's. A container image that includes a trojanized decompression binary can achieve code execution as the daemon process whenever a compressed archive is uploaded to that container.
The executed binary runs with the daemon's full privileges, including host root UID and unrestricted capabilities.
Impact
Arbitrary code execution as host root, crossing the container-to-host trust boundary.
Conditions for exploitation
- A user must run a container from a malicious image that contains a trojanized decompression binary.
- The user must then upload a compressed archive (xz or gzip) into that container, either by piping a compressed archive via
docker cp -or by calling thePUT /containers/{id}/archiveAPI directly with compressed content.
Not affected
Standard docker cp usage is not affected, because the CLI sends uncompressed tar by default:
docker cp ./file.txt mycontainer:/file.txt
This can only be exploited when explicitly passing a xz or gzip-compressed archive to docker cp or the PUT /containers/{id}/archive API, for example:
cat archive.tar.xz | docker cp - mycontainer:/dir
Decompression formats using pure Go implementations (bzip2, zstd, and gzip when the container image does not contain an unpigz binary) are also not affected.
Workarounds
- Only run containers from trusted images.
- Use authorization plugins to limit access to the
PUT /containers/{id}/archiveendpoint. - Avoid piping compressed archives into containers created from untrusted images.
Common Weakness Enumeration (CWE)
Uncontrolled Search Path Element
Uncontrolled Search Path Element
GitHub
0.8
CVSS SCORE
7.2high| Package | Type | OS Name | OS Version | Affected Ranges | Fix Versions |
|---|---|---|---|---|---|
| github.com/docker/docker | golang | - | - | <=28.5.2 | Not yet available |
| github.com/moby/moby | golang | - | - | <=28.5.2 | Not yet available |
| github.com/moby/moby/v2 | golang | - | - | <2.0.0-beta.14 | 2.0.0-beta.14 |
| github.com/moby/moby/v2 | golang | - | - | <0.0.0-20260518145843-dd24a3adc1db | 0.0.0-20260518145843-dd24a3adc1db |
CVSS:3 Severity and metrics
The CVSS metrics represent different qualitative aspects of a vulnerability that impact the overall score, as defined by the CVSS Specification.
The vulnerable component is not bound to the network stack and the attacker's path is via read/write/execute capabilities. Either: The attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document).
A successful attack depends on conditions beyond the attacker's control, requiring investing a measurable amount of effort in research, preparation, or execution against the vulnerable component before a successful attack.
The attacker requires privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.
Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited. For example, a successful exploit may only be possible during the installation of an application by a system administrator.
An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
There is a total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.
There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any or all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
There is no impact to availability within the impacted component.
NIST
0.8
CVSS SCORE
7.2highAlpine
-
Debian
-
Ubuntu
-
CVSS SCORE
N/AmediumGoLang
-
Amazon
-
CVSS SCORE
N/AhighChainguard
CGA-37fr-7h3x-r97v
-
Photon
CVE-2026-41567
-
CVSS SCORE
7.5highminimos
MINI-24j3-frcg-cqj9
-
minimos
MINI-2695-585v-cqgc
-
minimos
MINI-28fm-6w93-2x84
-
minimos
MINI-29h7-5g8v-36q4
-
minimos
MINI-2hgv-68fw-g55r
-
minimos
MINI-322h-6439-v2q5
-
minimos
MINI-33fj-6rgw-45j9
-
minimos
MINI-33xg-557f-v59h
-
minimos
MINI-34pp-ccqx-4j4v
-
minimos
MINI-38cj-5g25-crm4
-
minimos
MINI-38rj-4mcv-qw57
-
minimos
MINI-39cf-7j7j-2mpc
-
minimos
MINI-3c7g-pj4m-jpv2
-
minimos
MINI-3ccp-p4rp-p795
-
minimos
MINI-3fpw-x997-q7mc
-
minimos
MINI-3qfr-5vrg-5r2x
-
minimos
MINI-3rcq-g8pj-34r4
-
minimos
MINI-3vjr-hmwh-hqv2
-
minimos
MINI-42fv-qvcv-cfp7
-
minimos
MINI-43h2-qwpr-6vfc
-
minimos
MINI-46j8-9wrv-m925
-
minimos
MINI-47m6-prq7-5h7p
-
minimos
MINI-4crm-r2rm-ffpr
-
minimos
MINI-4f3c-6h5v-w549
-
minimos
MINI-4fww-23wv-8fxj
-
minimos
MINI-4gj2-9cwj-j4hm
-
minimos
MINI-4p23-4w7g-4vq7
-
minimos
MINI-4q9r-4855-w4xc
-
minimos
MINI-4qw3-m48f-w235
-
minimos
MINI-4qwj-9whw-hw28
-
minimos
MINI-4vm5-ffcm-x8cp
-
minimos
MINI-4vm7-fh34-pv64
-
minimos
MINI-4wx3-3c99-pggr
-
minimos
MINI-55fr-9cgp-x587
-
minimos
MINI-55gf-68f5-qrw3
-
minimos
MINI-596x-qv5q-366g
-
minimos
MINI-5c4w-3gm8-rgp5
-
minimos
MINI-5fjh-xgr6-qjf4
-
minimos
MINI-5h5g-fhq6-phx8
-
minimos
MINI-5h75-4rwv-99ww
-
minimos
MINI-5j7q-q988-c2r2
-
minimos
MINI-5m7v-xh5v-96mh
-
minimos
MINI-5r98-vq7v-2vq6
-
minimos
MINI-5v7r-3xmm-m554
-
minimos
MINI-62pw-g2cr-q369
-
minimos
MINI-6646-2xjc-hc7r
-
minimos
MINI-6h47-q9mx-62wj
-
minimos
MINI-6mf4-fpq4-g8hr
-
minimos
MINI-6ppj-fj8g-f5fp
-
minimos
MINI-6rx3-hv73-cw63
-
minimos
MINI-6v4c-prqg-897f
-
minimos
MINI-6v6v-85r8-pxf5
-
minimos
MINI-6xr2-69xc-v6r6
-
minimos
MINI-72qv-29gf-x9mm
-
minimos
MINI-72ww-h3vj-xgh5
-
minimos
MINI-7329-cx27-f2pp
-
minimos
MINI-737w-4g6j-722c
-
minimos
MINI-73px-6q89-7rjf
-
minimos
MINI-747q-74mv-gm5f
-
minimos
MINI-74mr-r2xh-r7c8
-
minimos
MINI-752p-wh37-f8pr
-
minimos
MINI-754r-c36w-mc53
-
minimos
MINI-7589-w6qv-mqmw
-
minimos
MINI-7ffw-7chf-fjrf
-
minimos
MINI-7j8j-2gvf-jwrx
-
minimos
MINI-7m2x-223x-mjm5
-
minimos
MINI-7m9j-wgj6-g3p8
-
minimos
MINI-7v2c-g984-2m8m
-
minimos
MINI-7wx7-g3vj-vpf3
-
minimos
MINI-82cq-xcp5-2mmx
-
minimos
MINI-82gp-rr77-x44f
-
minimos
MINI-82mr-q23r-45cg
-
minimos
MINI-84w6-g56j-mr7j
-
minimos
MINI-85vg-73gj-9ghg
-
minimos
MINI-8736-2w6g-929w
-
minimos
MINI-88jr-x2w7-p3m5
-
minimos
MINI-899m-7jq6-qxj7
-
minimos
MINI-89wq-534v-qgjq
-
minimos
MINI-8fjm-5pp9-ppqx
-
minimos
MINI-8fqv-6r2h-gm8m
-
minimos
MINI-8hrq-27mg-jhm8
-
minimos
MINI-8j5c-qxrq-5vx6
-
minimos
MINI-8mrv-2gcq-q797
-
minimos
MINI-8rcr-w5j9-v9f9
-
minimos
MINI-8rrj-pg99-9ww6
-
minimos
MINI-8w7j-rxv9-fwpx
-
minimos
MINI-8wp5-832g-2fxv
-
minimos
MINI-8wqx-cf8x-7fmg
-
minimos
MINI-8xqf-5crf-6827
-
minimos
MINI-9229-h749-mc2c
-
minimos
MINI-93pv-gjx7-3x8g
-
minimos
MINI-96qp-m82h-rfm8
-
minimos
MINI-98r8-rj3h-ww47
-
minimos
MINI-99wg-7x36-8mf4
-
minimos
MINI-9jf2-gm26-hpwc
-
minimos
MINI-9jh3-cc75-xx2j
-
minimos
MINI-9jxv-9qv9-6926
-
minimos
MINI-9m94-9fjx-fhwv
-
minimos
MINI-9p62-3h44-f47h
-
minimos
MINI-9r26-rfmh-45fr
-
minimos
MINI-c28f-h2c6-mwgw
-
minimos
MINI-c6ph-q4m5-73mg
-
minimos
MINI-cjmr-f6jw-p4pm
-
minimos
MINI-cmqr-9mc5-gvqj
-
minimos
MINI-crv9-2g4r-wp65
-
minimos
MINI-cwjv-qm5x-x2h4
-
minimos
MINI-f366-f5jm-3q3m
-
minimos
MINI-f3ph-5mhm-rwpj
-
minimos
MINI-f3r2-jppf-9h27
-
minimos
MINI-f4cg-9c2m-w7fg
-
minimos
MINI-f5c4-mrhp-5ffc
-
minimos
MINI-f5hv-vccw-5qq2
-
minimos
MINI-f6fh-hgjx-g5ph
-
minimos
MINI-f7g7-r2w4-9qw7
-
minimos
MINI-fgww-j9ww-pwxg
-
minimos
MINI-fh3x-5m3g-88gm
-
minimos
MINI-fh93-vjrr-2c8j
-
minimos
MINI-fhhx-mwh9-ppmc
-
minimos
MINI-fm5c-px2p-c96g
-
minimos
MINI-fvm5-qg38-jw48
-
minimos
MINI-fw52-qgh5-f27c
-
minimos
MINI-fw8g-h9x8-q8xc
-
minimos
MINI-g276-w53c-g9f8
-
minimos
MINI-g2f2-pw64-fgfg
-
minimos
MINI-g2r4-8852-xj4q
-
minimos
MINI-g652-qf5w-p3gr
-
minimos
MINI-g7hj-w5wp-964g
-
minimos
MINI-g7p3-5964-x885
-
minimos
MINI-g7wm-7cmp-9cfw
-
minimos
MINI-g8hw-3wrh-hg8x
-
minimos
MINI-gf4g-2p2m-j3g3
-
minimos
MINI-gfgh-x3v6-3rqc
-
minimos
MINI-gjmx-w774-pjpr
-
minimos
MINI-gxh6-q9v9-q623
-
minimos
MINI-h535-fq8h-84m6
-
minimos
MINI-h5cj-3v23-h75q
-
minimos
MINI-h5qm-6c45-wm4m
-
minimos
MINI-h7g8-5gjv-8x85
-
minimos
MINI-hcfp-vfh6-r4rc
-
minimos
MINI-hg5w-f3jm-cvf8
-
minimos
MINI-hg8f-q6xj-mpmv
-
minimos
MINI-hhgm-c749-999h
-
minimos
MINI-hmgx-h24r-353w
-
minimos
MINI-hmqv-hfh7-5j7f
-
minimos
MINI-hqrc-gfp3-mhhq
-
minimos
MINI-hrmq-6762-3x7c
-
minimos
MINI-hw89-73gm-vhfv
-
minimos
MINI-j24j-3f8g-rr5h
-
minimos
MINI-j4pp-cxg4-p4fv
-
minimos
MINI-j525-j569-2jw3
-
minimos
MINI-j658-m9q3-q973
-
minimos
MINI-j6cv-hpxv-vmxx
-
minimos
MINI-j7rr-qvx6-8r2h
-
minimos
MINI-j855-6vpp-7mjw
-
minimos
MINI-j8m6-pxqf-p7r6
-
minimos
MINI-j8pv-f5p6-pgxj
-
minimos
MINI-j8q4-qm7q-fcpp
-
minimos
MINI-jffh-qjq9-q6c4
-
minimos
MINI-jfgv-5699-xr6f
-
minimos
MINI-jfw2-grff-hj29
-
minimos
MINI-jgpp-fvgj-8jcr
-
minimos
MINI-jgqw-gqv5-6v43
-
minimos
MINI-jh3m-gfvh-hwmv
-
minimos
MINI-jjw9-v79f-ggmf
-
minimos
MINI-jmv3-9rxv-pppc
-
minimos
MINI-jpq6-hpwr-4rvm
-
minimos
MINI-jqm7-5f8w-h628
-
minimos
MINI-jvfq-j8mm-xr4m
-
minimos
MINI-jvhx-554q-6qgq
-
minimos
MINI-m5j6-52xc-97cp
-
minimos
MINI-m5pq-fm4f-xfc4
-
minimos
MINI-m6r9-fx5w-qcpq
-
minimos
MINI-m8qr-hx2c-q7h7
-
minimos
MINI-mcmc-fpqg-92q8
-
minimos
MINI-mgxc-4cr2-jjvm
-
minimos
MINI-mjhm-p2mv-jh6f
-
minimos
MINI-mrc5-2228-r34v
-
minimos
MINI-mw49-hf7j-652x
-
minimos
MINI-mxgg-ph2g-q59j
-
minimos
MINI-p4c6-fv4x-2qff
-
minimos
MINI-p4j5-7x9w-hwqp
-
minimos
MINI-p9m4-4m2g-x5g6
-
minimos
MINI-pfg2-qjpr-f3pc
-
minimos
MINI-ph42-jw8h-7fcq
-
minimos
MINI-phq2-jq9v-972v
-
minimos
MINI-ppqw-7g72-g6mc
-
minimos
MINI-pqv4-vpxv-vh6j
-
minimos
MINI-pr75-482w-phr6
-
minimos
MINI-pvhr-xw52-c2wg
-
minimos
MINI-pwh3-rm5c-hwv3
-
minimos
MINI-q272-8m6q-gxwr
-
minimos
MINI-q2r4-2989-x3xg
-
minimos
MINI-q895-7vpr-hg8x
-
minimos
MINI-q8px-33qj-qm42
-
minimos
MINI-q9xh-4xv4-c228
-
minimos
MINI-qhp8-mwfh-ghh6
-
minimos
MINI-qpfp-fm5j-ffjv
-
minimos
MINI-qpwx-7pm9-c4gq
-
minimos
MINI-qq8x-q2pv-v9fj
-
minimos
MINI-qrcm-qp25-3j3v
-
minimos
MINI-qvvh-crr5-3cjv
-
minimos
MINI-qw7q-876w-7mj9
-
minimos
MINI-qx35-wprp-7xq4
-
minimos
MINI-qxpw-57w8-j2mc
-
minimos
MINI-r28g-789h-qcgh
-
minimos
MINI-r2x9-fqcj-c7pm
-
minimos
MINI-r347-q393-6fg4
-
minimos
MINI-r36m-c7gw-w2fv
-
minimos
MINI-r5f4-38fj-66xj
-
minimos
MINI-r67p-cxjm-8xhh
-
minimos
MINI-r86c-2gj4-93xr
-
minimos
MINI-r97q-6fcj-72xh
-
minimos
MINI-rcxf-w62m-prwf
-
minimos
MINI-rh9r-mr45-r9f3
-
minimos
MINI-rmww-x929-3f66
-
minimos
MINI-rp3x-vx4h-rmxj
-
minimos
MINI-rprj-w84x-h76m
-
minimos
MINI-rrcq-5m7p-r8v8
-
minimos
MINI-rwwq-86r4-4hgm
-
minimos
MINI-v4wh-cxrh-fcr9
-
minimos
MINI-v592-f53r-fhff
-
minimos
MINI-v7f8-x977-28xm
-
minimos
MINI-v7p2-7jgg-fjhh
-
minimos
MINI-v7rc-pw77-mrwp
-
minimos
MINI-v8hx-qwwh-hh7p
-
minimos
MINI-v962-575w-587w
-
minimos
MINI-vc57-4p86-5hm8
-
minimos
MINI-vf97-rg8f-378w
-
minimos
MINI-vg2r-3gvf-f449
-
minimos
MINI-vh2g-5953-xj4j
-
minimos
MINI-vj43-76jw-23wx
-
minimos
MINI-vx99-fgcw-rfh8
-
minimos
MINI-vxh4-6676-c2x3
-
minimos
MINI-vxrq-77cf-7f9g
-
minimos
MINI-w57r-8xrh-4j79
-
minimos
MINI-whr2-jwh4-w728
-
minimos
MINI-wj45-4v3p-294g
-
minimos
MINI-wmwg-wcf6-w7c6
-
minimos
MINI-wrvw-8m5j-6w5x
-
minimos
MINI-wv57-xqg4-97rr
-
minimos
MINI-wvpf-rh8f-g3rr
-
minimos
MINI-x338-3x4q-mjh4
-
minimos
MINI-x45f-j7xc-grh5
-
minimos
MINI-x4v5-c8cr-c72g
-
minimos
MINI-x696-jhxh-f28h
-
minimos
MINI-x6g4-7q4r-698q
-
minimos
MINI-x86q-2gr4-666p
-
minimos
MINI-x9cc-26v3-wwhw
-
minimos
MINI-xhhf-6p9f-8872
-
minimos
MINI-xq7r-rwq5-ppj9
-
minimos
MINI-xr56-cgm8-w7g7
-
minimos
MINI-xw66-7fr4-424c
-
minimos
MINI-xwpc-5vp4-2f55
-
minimos
MINI-xx8v-37wp-wc7w
-
minimos
MINI-xxw7-8j33-5g84
-