High severity7.2GHSA Advisory· Published Jun 12, 2026· Updated Jun 16, 2026

CVE-2026-42306

Description

Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/docker/dockerGo	<= 28.5.2	—
github.com/moby/moby/v2Go	< 2.0.0-beta.14	2.0.0-beta.14
github.com/moby/mobyGo	<= 28.5.2	—

Affected products

131

Mobyproject/MobyGHSA16 versions
<= 28.5.2+ 15 more
- (no CPE)range: <= 28.5.2
- cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:*range: <=28.5.2
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta0:*:*:*:*:*:*
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta10:*:*:*:*:*:*
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta11:*:*:*:*:*:*
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta12:*:*:*:*:*:*
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta13:*:*:*:*:*:*
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta5:*:*:*:*:*:*
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta6:*:*:*:*:*:*
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta7:*:*:*:*:*:*
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta8:*:*:*:*:*:*
- cpe:2.3:a:mobyproject:moby\/v2:2.0.0:beta9:*:*:*:*:*:*
Docker/Engine
cpe:2.3:a:docker:engine:*:*:*:*:*:*:*:*
Range: <29.5.1
osv-coords114 versions
pkg:apk/chainguard/auditbeat-8.19 pkg:apk/chainguard/auditbeat-9.3 pkg:apk/chainguard/auditbeat-9.4 pkg:apk/chainguard/auditbeat-fips-8.19 pkg:apk/chainguard/auditbeat-fips-9.3 pkg:apk/chainguard/auditbeat-fips-9.4 pkg:apk/chainguard/aws-otel-collector pkg:apk/chainguard/aws-otel-collector-fips pkg:apk/chainguard/buildah pkg:apk/chainguard/buildah-fips pkg:apk/chainguard/chainloop-control-plane pkg:apk/chainguard/chainloop-control-plane-fips pkg:apk/chainguard/datadog-agent-7.77-full pkg:apk/chainguard/dockerd-fips-29 pkg:apk/chainguard/elastic-agent-8.19 pkg:apk/chainguard/elastic-agent-9.3 pkg:apk/chainguard/elastic-agent-9.4 pkg:apk/chainguard/elastic-agent-fips-8.19 pkg:apk/chainguard/elastic-agent-fips-9.3 pkg:apk/chainguard/elastic-agent-fips-9.4 pkg:apk/chainguard/elastic-otel-collector-9.3 pkg:apk/chainguard/elastic-otel-collector-9.4 pkg:apk/chainguard/elastic-otel-collector-fips-9.3 pkg:apk/chainguard/elastic-otel-collector-fips-9.4 pkg:apk/chainguard/envoy-gateway-egctl pkg:apk/chainguard/envoy-gateway-fips-egctl pkg:apk/chainguard/filebeat-8.19 pkg:apk/chainguard/filebeat-9.3 pkg:apk/chainguard/filebeat-9.4 pkg:apk/chainguard/filebeat-fips-8.19 pkg:apk/chainguard/filebeat-fips-9.3 pkg:apk/chainguard/filebeat-fips-9.4 pkg:apk/chainguard/google-cloud-otel-ops-collector pkg:apk/chainguard/grafana-12.3 pkg:apk/chainguard/grafana-12.4 pkg:apk/chainguard/grafana-13.0 pkg:apk/chainguard/grafana-fips-12.3 pkg:apk/chainguard/grafana-fips-12.4 pkg:apk/chainguard/grafana-fips-13.0 pkg:apk/chainguard/heartbeat-8.19 pkg:apk/chainguard/heartbeat-9.3 pkg:apk/chainguard/heartbeat-9.4 pkg:apk/chainguard/heartbeat-fips-8.19 pkg:apk/chainguard/heartbeat-fips-9.3 pkg:apk/chainguard/heartbeat-fips-9.4 pkg:apk/chainguard/ko pkg:apk/chainguard/ko-fips pkg:apk/chainguard/metricbeat-8.19 pkg:apk/chainguard/metricbeat-9.3 pkg:apk/chainguard/metricbeat-9.4 pkg:apk/chainguard/metricbeat-fips-8.19 pkg:apk/chainguard/metricbeat-fips-9.3 pkg:apk/chainguard/metricbeat-fips-9.4 pkg:apk/chainguard/nerdctl pkg:apk/chainguard/nerdctl-fips pkg:apk/chainguard/nrdot-collector-k8s-fips pkg:apk/chainguard/nuclei pkg:apk/chainguard/podman pkg:apk/chainguard/podman-fips pkg:apk/chainguard/portieris pkg:apk/chainguard/portieris-fips pkg:apk/chainguard/prometheus-2.51 pkg:apk/chainguard/prometheus-3.10 pkg:apk/chainguard/prometheus-3.11 pkg:apk/chainguard/prometheus-3.5 pkg:apk/chainguard/prometheus-3.8 pkg:apk/chainguard/prometheus-fips-3.10 pkg:apk/chainguard/prometheus-fips-3.11 pkg:apk/chainguard/prometheus-fips-3.5 pkg:apk/chainguard/prometheus-fips-3.8 pkg:apk/chainguard/prometheus-fips-3.9 pkg:apk/chainguard/py3-docker pkg:apk/chainguard/rancher-2.12 pkg:apk/chainguard/rancher-2.13 pkg:apk/chainguard/rancher-2.14 pkg:apk/chainguard/rancher-agent-2.12 pkg:apk/chainguard/rancher-agent-2.13 pkg:apk/chainguard/rancher-agent-2.14 pkg:apk/chainguard/rancher-machine pkg:apk/chainguard/skopeo pkg:apk/chainguard/skopeo-fips pkg:apk/chainguard/trivy pkg:apk/chainguard/trivy-fips pkg:apk/chainguard/undock pkg:apk/chainguard/upwind-agent pkg:apk/chainguard/zot pkg:apk/wolfi/aws-otel-collector pkg:apk/wolfi/buildah pkg:apk/wolfi/datadog-agent-7.77-full pkg:apk/wolfi/envoy-gateway-egctl pkg:apk/wolfi/grafana-12.3 pkg:apk/wolfi/grafana-12.4 pkg:apk/wolfi/grafana-13.0 pkg:apk/wolfi/ko pkg:apk/wolfi/nerdctl pkg:apk/wolfi/nuclei pkg:apk/wolfi/podman pkg:apk/wolfi/portieris pkg:apk/wolfi/prometheus-3.10 pkg:apk/wolfi/prometheus-3.11 pkg:apk/wolfi/prometheus-3.5 pkg:apk/wolfi/prometheus-3.8 pkg:apk/wolfi/py3-docker pkg:apk/wolfi/rancher-2.12 pkg:apk/wolfi/rancher-2.13 pkg:apk/wolfi/rancher-2.14 pkg:apk/wolfi/rancher-agent-2.12 pkg:apk/wolfi/rancher-agent-2.13 pkg:apk/wolfi/rancher-agent-2.14 pkg:apk/wolfi/rancher-machine pkg:apk/wolfi/skopeo pkg:apk/wolfi/trivy pkg:apk/wolfi/undock pkg:apk/wolfi/zot
< 8.19.17-r0+ 113 more
- (no CPE)range: < 8.19.17-r0
- (no CPE)range: < 9.3.6-r0
- (no CPE)range: < 9.4.3-r0
- (no CPE)range: < 8.19.17-r0
- (no CPE)range: < 9.3.6-r0
- (no CPE)range: < 9.4.3-r0
- (no CPE)range: < 0.48.0-r0
- (no CPE)range: < 0.48.0-r0
- (no CPE)range: < 1.44.0-r0
- (no CPE)range: < 1.44.0-r0
- (no CPE)range: < 1.100.8-r0
- (no CPE)range: < 1.100.8-r0
- (no CPE)range: < 7.77.3-r10
- (no CPE)range: < 29.5.2-r0
- (no CPE)range: < 8.19.17-r0
- (no CPE)range: < 9.3.6-r0
- (no CPE)range: < 9.4.3-r0
- (no CPE)range: < 8.19.17-r0
- (no CPE)range: < 9.3.6-r0
- (no CPE)range: < 9.4.3-r0
- (no CPE)range: < 9.3.6-r0
- (no CPE)range: < 9.4.3-r0
- (no CPE)range: < 9.3.6-r0
- (no CPE)range: < 9.4.3-r0
- (no CPE)range: < 1.8.2-r0
- (no CPE)range: < 1.8.2-r0
- (no CPE)range: < 8.19.17-r0
- (no CPE)range: < 9.3.6-r0
- (no CPE)range: < 9.4.3-r0
- (no CPE)range: < 8.19.17-r0
- (no CPE)range: < 9.3.6-r0
- (no CPE)range: < 9.4.3-r0
- (no CPE)range: < 0.151.0-r0
- (no CPE)range: < 12.3.7-r0
- (no CPE)range: < 12.4.4-r0
- (no CPE)range: < 13.0.2-r0
- (no CPE)range: < 12.3.7-r0
- (no CPE)range: < 12.4.4-r0
- (no CPE)range: < 13.0.2-r0
- (no CPE)range: < 8.19.17-r0
- (no CPE)range: < 9.3.6-r0
- (no CPE)range: < 9.4.3-r0
- (no CPE)range: < 8.19.17-r0
- (no CPE)range: < 9.3.6-r0
- (no CPE)range: < 9.4.3-r0
- (no CPE)range: < 0.19.0-r0
- (no CPE)range: < 0.19.0-r0
- (no CPE)range: < 8.19.17-r0
- (no CPE)range: < 9.3.6-r0
- (no CPE)range: < 9.4.3-r0
- (no CPE)range: < 8.19.17-r0
- (no CPE)range: < 9.3.6-r0
- (no CPE)range: < 9.4.3-r0
- (no CPE)range: < 2.3.1-r0
- (no CPE)range: < 2.3.1-r0
- (no CPE)range: < 1.12.0-r4
- (no CPE)range: < 3.9.0-r0
- (no CPE)range: < 6.0.0-r0
- (no CPE)range: < 6.0.0-r0
- (no CPE)range: < 0.14.1-r0
- (no CPE)range: < 0.14.1-r0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 2.12.11-r0
- (no CPE)range: < 2.13.7-r0
- (no CPE)range: < 2.14.3-r0
- (no CPE)range: < 2.12.11-r0
- (no CPE)range: < 2.13.7-r0
- (no CPE)range: < 2.14.3-r0
- (no CPE)range: < 0.15.0.144-r0
- (no CPE)range: < 1.23.0-r0
- (no CPE)range: < 1.23.0-r0
- (no CPE)range: < 0.70.0-r0
- (no CPE)range: < 0.70.0-r0
- (no CPE)range: < 0.14.0-r0
- (no CPE)range: < 0.130.0-r0
- (no CPE)range: < 2.1.17-r0
- (no CPE)range: < 0.48.0-r0
- (no CPE)range: < 1.44.0-r0
- (no CPE)range: < 7.77.3-r10
- (no CPE)range: < 1.8.2-r0
- (no CPE)range: < 12.3.7-r0
- (no CPE)range: < 12.4.4-r0
- (no CPE)range: < 13.0.2-r0
- (no CPE)range: < 0.19.0-r0
- (no CPE)range: < 2.3.1-r0
- (no CPE)range: < 3.9.0-r0
- (no CPE)range: < 6.0.0-r0
- (no CPE)range: < 0.14.1-r0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 2.12.11-r0
- (no CPE)range: < 2.13.7-r0
- (no CPE)range: < 2.14.3-r0
- (no CPE)range: < 2.12.11-r0
- (no CPE)range: < 2.13.7-r0
- (no CPE)range: < 2.14.3-r0
- (no CPE)range: < 0.15.0.144-r0
- (no CPE)range: < 1.23.0-r0
- (no CPE)range: < 0.70.0-r0
- (no CPE)range: < 0.14.0-r0
- (no CPE)range: < 2.1.17-r0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-rg2x-37c3-w2rhghsaADVISORY
github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rhnvdMitigationVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2026-42306ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.468
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000