VYPR
← All advisories
High severity7.2GHSA Advisory· Published Jun 12, 2026· Updated Jun 16, 2026

CVE-2026-42306

CVE-2026-42306

Description

Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/docker/dockerGo
<= 28.5.2—
github.com/moby/moby/v2Go
< 2.0.0-beta.142.0.0-beta.14
github.com/moby/mobyGo
<= 28.5.2—

Affected products

279

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.