CVE-2026-41567Docker: `PUT /containers/{id}/archive` executes container binary on the host
- 7.2HighCVSS base score
- 0.32%Exploitation in 30 daysEPSS · top 75% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images
Timeline
ID reserved
By GitHub_M
- 45 days later
· 45 days later
Published
- 3 months later
· 3 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High7.2 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N |
| redhat-SADPADP (enrichment) | 3.1 | High7.5 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
| NVDNVD · Awaiting Analysis | 3.1 | High7.2 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N |
- EPSS (exploitation in 30 days)
- 0.32% · top 75% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.
Affected products
- affected < 2.0.0-beta.14
- affected < 29.5.1
- affected <= 28.5.2
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Gogithub.com/docker/dockerGHSA-x86f-5xw2-fm2r (opens in a new tab)
- Gogithub.com/moby/mobyGHSA-x86f-5xw2-fm2r (opens in a new tab)
- Gogithub.com/moby/moby/v2GHSA-x86f-5xw2-fm2r (opens in a new tab)
References
References9
- https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r (opens in a new tab)x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-41567 (opens in a new tab)vdb-entryx_refsource_REDHAT
- RHBZ#2485356 (opens in a new tab)issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41567.json (opens in a new tab)x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:41030 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:44622 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:51057 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37387 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42852 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-34779 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-x86f-5xw2-fm2r (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-41567)Record last updated .