CVE-2026-42306
ADVISORY - githubSummary
Summary
A race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service.
Details
When copying files into a container, the daemon sets up a temporary filesystem view by bind-mounting volumes into a private mount namespace. During this setup, the mount destination is created inside the container root and then a bind mount is attached using the container-relative path resolved to an absolute host path.
Between mountpoint creation and the mount() syscall, a process running inside the container can replace the destination (or a parent path component) with a symlink pointing to an arbitrary location on the host. The mount() syscall follows the symlink, causing the volume to be bind-mounted onto an arbitrary host path instead of the intended container path.
Impact
A malicious container can redirect a volume bind mount to an arbitrary host path. The impact depends on the volume content and mount options:
- If the volume is writable, arbitrary host files at the redirected path could be overwritten with the volume's contents.
- If the volume is read-only, the host path is masked by the mount for the duration of the operation, causing denial of service.
- In all cases the mount is temporary (torn down after the
docker cpcompletes), but the effects of any writes persist.
Conditions for exploitation
- A container must have at least one volume mount.
- A process inside the container must be able to rapidly create and swap symlinks at the volume mount destination path.
- An operator must initiate a
docker cpinto that container, or call thePUT /containers/{id}/archiveorHEAD /containers/{id}/archiveAPI endpoints.
Not affected
- Containers that do not have volume mounts are not affected, as the race occurs during volume bind-mount setup.
Workarounds
- Only run containers from trusted images.
- Avoid using
docker cpwith untrusted running containers. - Use authorization plugins to restrict access to the archive API endpoints (
PUT /containers/{id}/archive,HEAD /containers/{id}/archive).
GitHub
CVSS SCORE
7.2highAmazon
-
CVSS SCORE
N/AhighChainguard
CGA-cjw6-g67q-rwx9
-
minimos
MINI-253q-6qr7-c6cg
-
minimos
MINI-2vrg-4wvm-573p
-
minimos
MINI-3g54-4vqw-3j6w
-
minimos
MINI-3pcf-7pgm-rpxf
-
minimos
MINI-3v42-3863-c3hh
-
minimos
MINI-3vq4-ppgj-6hc2
-
minimos
MINI-3vwh-vm32-8c38
-
minimos
MINI-46v5-mfp4-ch45
-
minimos
MINI-4gq5-2chh-wxpr
-
minimos
MINI-4hx2-23wp-49x6
-
minimos
MINI-552m-vj9v-rfj8
-
minimos
MINI-56gg-6vmq-mxvh
-
minimos
MINI-57rw-mvxq-p7jh
-
minimos
MINI-5f75-p49h-hfjp
-
minimos
MINI-5fjj-9cvv-m82f
-
minimos
MINI-5gh6-cqjw-j73m
-
minimos
MINI-5wq6-vpq5-9gqh
-
minimos
MINI-5xw5-p9m2-3pqf
-
minimos
MINI-62q5-vc7h-qjr9
-
minimos
MINI-656c-pjjw-gv2p
-
minimos
MINI-66mf-rmpg-jfhf
-
minimos
MINI-6m33-p384-gw8q
-
minimos
MINI-6m8g-85rw-qm7c
-
minimos
MINI-6pmh-8352-5w7r
-
minimos
MINI-6qm9-m8jr-m4mh
-
minimos
MINI-6rvx-3hc9-2925
-
minimos
MINI-74jw-4v9v-m2gv
-
minimos
MINI-789q-xrr9-px5f
-
minimos
MINI-7cg3-5w72-vvf5
-
minimos
MINI-7fpc-x5f3-jw4h
-
minimos
MINI-7gp3-qqcx-h7w2
-
minimos
MINI-7rhx-9jg5-4w84
-
minimos
MINI-8666-f4vg-mf3f
-
minimos
MINI-88xq-3p8p-6mhx
-
minimos
MINI-89m6-69qq-wvv5
-
minimos
MINI-8m6p-c9rv-wpjc
-
minimos
MINI-8pr7-p667-wp38
-
minimos
MINI-8qq3-xr9p-m5cc
-
minimos
MINI-92wj-mjq5-r2hh
-
minimos
MINI-92xc-h5q7-qf99
-
minimos
MINI-932h-f4qj-7638
-
minimos
MINI-98hg-69r9-hw3f
-
minimos
MINI-9c29-3p7m-6rc6
-
minimos
MINI-9h8h-v3pm-jv27
-
minimos
MINI-9jv9-g3jg-r8xr
-
minimos
MINI-9pc3-hjvv-jwch
-
minimos
MINI-9vx4-j9ww-6vvg
-
minimos
MINI-9w84-7qx3-x4w2
-
minimos
MINI-9w8v-79rj-2qm5
-
minimos
MINI-c45p-8h9r-q7vf
-
minimos
MINI-c7q6-9rfh-8366
-
minimos
MINI-cc95-c348-9h7q
-
minimos
MINI-cp43-crq6-62c2
-
minimos
MINI-cxhw-hjh4-3mxw
-
minimos
MINI-f27q-crm3-mf7g
-
minimos
MINI-f3jw-cxwr-88r2
-
minimos
MINI-f776-342p-hvqx
-
minimos
MINI-f79f-w77h-v668
-
minimos
MINI-f89x-9xc4-xcr5
-
minimos
MINI-fc4c-fg5v-xf28
-
minimos
MINI-ff2q-4q34-vwqc
-
minimos
MINI-ff7q-8366-rrpp
-
minimos
MINI-g649-3j56-x22m
-
minimos
MINI-g8p4-p92q-q3j8
-
minimos
MINI-g93j-r85h-4jgf
-
minimos
MINI-gwv6-q53v-6x86
-
minimos
MINI-h42h-p2jv-ffrw
-
minimos
MINI-h4gx-wx25-493x
-
minimos
MINI-h5p3-7fqc-c3h3
-
minimos
MINI-hjxq-7prg-8fjx
-
minimos
MINI-j6q9-3737-w492
-
minimos
MINI-j75m-3f8v-85f7
-
minimos
MINI-j7j6-hp54-w9x8
-
minimos
MINI-jcxw-5889-c56j
-
minimos
MINI-jggw-64pc-wc6m
-
minimos
MINI-jwm6-x999-vj2h
-
minimos
MINI-m2gp-fw32-w9g9
-
minimos
MINI-p28v-8x9f-3wg9
-
minimos
MINI-p2xq-xrcf-5g5f
-
minimos
MINI-p49v-x2vw-fxph
-
minimos
MINI-p8cc-hg3h-c2q6
-
minimos
MINI-pr3x-g64q-pv7v
-
minimos
MINI-pw8g-qprm-9wf2
-
minimos
MINI-pxf4-w8c4-27cf
-
minimos
MINI-q7mf-c3x7-xhf7
-
minimos
MINI-q82h-g6m4-7r85
-
minimos
MINI-q9xq-pj4v-cc6x
-
minimos
MINI-qjr7-5mch-fg4r
-
minimos
MINI-qqr8-7983-644h
-
minimos
MINI-qxvf-rprg-mr5c
-
minimos
MINI-r255-4rhw-6qp5
-
minimos
MINI-r297-9r3c-mpxp
-
minimos
MINI-rmq5-697q-xmc6
-
minimos
MINI-rrxv-3rj4-2786
-
minimos
MINI-rv35-5c5p-34w2
-
minimos
MINI-rv64-pv2w-mq6f
-
minimos
MINI-rw2f-v863-85ff
-
minimos
MINI-v552-8vvr-f338
-
minimos
MINI-v638-52v2-599h
-
minimos
MINI-v6c8-8vhg-gqqr
-
minimos
MINI-v86c-j6vj-g38x
-
minimos
MINI-vjgh-ccmv-x5p3
-
minimos
MINI-w3q2-g73w-gqgw
-
minimos
MINI-wj3x-98m9-974p
-
minimos
MINI-wm29-gw24-94q4
-
minimos
MINI-wq3g-55vx-jpxg
-
minimos
MINI-wwvj-f42x-w96m
-
minimos
MINI-x8g7-2gxc-5w9w
-
minimos
MINI-xf7g-5xv9-f5g7
-
minimos
MINI-xf8r-jw5q-74r9
-
minimos
MINI-xj6p-2f2q-cx6q
-
minimos
MINI-xjpv-6m3m-x62x
-
minimos
MINI-xw25-vjgg-pxcv
-