GHSA-x86f-5xw2-fm2r CVE-2026-41567 GO-2026-5746

Docker: `PUT /containers/{id}/archive` executes container binary on the host

High Go

Severity: 7.2 / 10; High · CVSS 3.1
Exploit chance (EPSS): 0.15%; Chance of exploitation in the next 30 days. Higher than 4.60% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-427 Uncontrolled Search Path Element
Fix: 2.0.0-beta.14; Upgrade github.com/moby/moby/v2 to this version or later

Description

Summary

When a user uploads a compressed archive into a container, a malicious image can execute arbitrary code with daemon (host root) privileges.

Details

When handling PUT /containers/{id}/archive requests with compressed archives, the daemon decompresses them using external system binaries. Due to incorrect ordering of operations, these binaries are resolved from the container's filesystem rather than the host's. A container image that includes a trojanized decompression binary can achieve code execution as the daemon process whenever a compressed archive is uploaded to that container.

The executed binary runs with the daemon's full privileges, including host root UID and unrestricted capabilities.

Impact

Arbitrary code execution as host root, crossing the container-to-host trust boundary.

Conditions for exploitation

A user must run a container from a malicious image that contains a trojanized decompression binary.
The user must then upload a compressed archive (xz or gzip) into that container, either by piping a compressed archive via docker cp - or by calling the PUT /containers/{id}/archive API directly with compressed content.

Not affected

Standard docker cp usage is not affected, because the CLI sends uncompressed tar by default:

docker cp ./file.txt mycontainer:/file.txt

This can only be exploited when explicitly passing a xz or gzip-compressed archive to docker cp or the PUT /containers/{id}/archive API, for example:

cat archive.tar.xz | docker cp - mycontainer:/dir

Decompression formats using pure Go implementations (bzip2, zstd, and gzip when the container image does not contain an unpigz binary) are also not affected.

Workarounds

Only run containers from trusted images.
Use authorization plugins to limit access to the PUT /containers/{id}/archive endpoint.
Avoid piping compressed archives into containers created from untrusted images.

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/docker/docker	`<= 28.5.2`	No fix yet
github.com/docker/docker	`all versions`	No fix yet
github.com/moby/moby	`<= 28.5.2`	No fix yet
github.com/moby/moby	`all versions`	No fix yet
github.com/moby/moby/v2	`< 2.0.0-beta.14`	`2.0.0-beta.14`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/moby/moby/v2 Go → `2.0.0-beta.14`

go

go get github.com/moby/moby/v2@v2.0.0-beta.14 && go mod tidy

Severity breakdown

CVSS 3.1 7.2

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack vector: Local
Attack complexity: High
Privileges required: Low
User interaction: Required
Scope: Changed
Confidentiality: High
Integrity: High
Availability: None

Weakness

CWE-427: Uncontrolled Search Path Element

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

How to prevent it

Architecture and Design, Implementation: Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
Implementation: When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
Implementation: Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
Implementation: Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory. Since this is a denylist approach, it might not be a complete solution.
Implementation: Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of finding the program using the PATH environment variable, while execl() and execv() require a full path.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2026-41567

Packages

github.com/moby/moby

Timeline

May 18, 2026 Published
Sep 10, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-rg2x-37c3-w2rh Docker: Race condition in docker cp allows bind mount redirection to host path	High	Also affects github.com/docker/docker
GHSA-vp62-88p7-qqf5 Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap	Medium	Also affects github.com/docker/docker
GO-2026-4887 Moby has AuthZ plugin bypass when provided oversized request bodies	High	Also affects github.com/docker/docker
GHSA-pxq6-2prw-chj9 Moby has an Off-by-one error in its plugin privilege validation	High	Also affects github.com/docker/docker
GHSA-4vq8-7jfc-9cvp Moby firewalld reload removes bridge network isolation	Medium	Also affects github.com/docker/docker
GHSA-x4rx-4gw3-53p4 Moby firewalld reload makes published container ports accessible from remote hosts	Medium	Also affects github.com/docker/docker
GHSA-v23v-6jw2-98fq Authz zero length regression	Critical	Also affects github.com/docker/docker
GHSA-xmmx-7jpf-fx42 Moby (Docker Engine) is vulnerable to Ambiguous OCI manifest parsing	Low	Also affects github.com/docker/docker

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor