CVE-2026-41567: CWE-427: Uncontrolled Search Path Element in moby moby/v2/daemon
Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images
AI Analysis
Technical Summary
Moby's daemon in versions before 29.5.1 and moby/moby v2 before v2.0.0-beta.14 improperly resolves decompression binaries (e.g., xz, unpigz) from the container filesystem rather than the host when uploading compressed archives via the PUT /containers/{id}/archive endpoint or docker cp. This uncontrolled search path element (CWE-427) allows a malicious container image containing trojanized decompression binaries to achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities. The vulnerability is addressed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Mitigations include running only trusted container images, restricting access to the archive upload API, and avoiding piping compressed archives into untrusted containers. The CVSS v3.1 score is 7.2 (high severity) with vector AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N. No official vendor patch advisory explicitly states remediation level, but the fix is available in the specified versions. Red Hat advisory references confirm the issue and provide additional context.
Potential Impact
Successful exploitation allows arbitrary code execution with full daemon privileges, including root access on the host and unrestricted capabilities. This can lead to complete host compromise when a user uploads a compressed archive into a container running a malicious image. The vulnerability affects the confidentiality and integrity of the host system but does not impact availability directly. The attack requires local access with the ability to upload archives to containers and user interaction (upload or piping archives).
Mitigation Recommendations
A fix is available in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Users should upgrade to these versions or later to remediate the vulnerability. Until patched, mitigations include running containers only from trusted images, using authorization plugins to restrict access to the PUT /containers/{id}/archive endpoint, and avoiding piping compressed archives into containers created from untrusted images. The Red Hat advisory does not indicate that no action is required or that the issue is already mitigated, so these mitigations and upgrades are recommended.
CVE-2026-41567: CWE-427: Uncontrolled Search Path Element in moby moby/v2/daemon
Description
Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images
CVSS v3.1
Score 7.2high
Affected software
pkg:github/moby/mobyRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Moby's daemon in versions before 29.5.1 and moby/moby v2 before v2.0.0-beta.14 improperly resolves decompression binaries (e.g., xz, unpigz) from the container filesystem rather than the host when uploading compressed archives via the PUT /containers/{id}/archive endpoint or docker cp. This uncontrolled search path element (CWE-427) allows a malicious container image containing trojanized decompression binaries to achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities. The vulnerability is addressed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Mitigations include running only trusted container images, restricting access to the archive upload API, and avoiding piping compressed archives into untrusted containers. The CVSS v3.1 score is 7.2 (high severity) with vector AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N. No official vendor patch advisory explicitly states remediation level, but the fix is available in the specified versions. Red Hat advisory references confirm the issue and provide additional context.
Potential Impact
Successful exploitation allows arbitrary code execution with full daemon privileges, including root access on the host and unrestricted capabilities. This can lead to complete host compromise when a user uploads a compressed archive into a container running a malicious image. The vulnerability affects the confidentiality and integrity of the host system but does not impact availability directly. The attack requires local access with the ability to upload archives to containers and user interaction (upload or piping archives).
Mitigation Recommendations
A fix is available in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Users should upgrade to these versions or later to remediate the vulnerability. Until patched, mitigations include running containers only from trusted images, using authorization plugins to restrict access to the PUT /containers/{id}/archive endpoint, and avoiding piping compressed archives into containers created from untrusted images. The Red Hat advisory does not indicate that no action is required or that the issue is already mitigated, so these mitigations and upgrades are recommended.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-21T14:15:21.957Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-41567","vendor":"Red Hat"}]
Threat ID: 6a222773e29bf47b5011e3d6
Added to database: 06/05/2026, 01:33:39 UTC
Last enriched: 07/30/2026, 01:40:40 UTC
Last updated: 07/31/2026, 21:26:43 UTC
Views: 146
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.