CVE-2026-92543: CWE-295: Improper Certificate Validation in Docker Docker Engine

Docker Engine classifies registry hostnames as insecure based on an any-match DNS check that includes loopback CIDRs (127.0.0.0/8 and ::1/128) by default. The function isCIDRMatch resolves all IP addresses for a hostname and returns true if any address matches these insecure CIDRs. However, because the transport layer re-dials the hostname rather than the specific CIDR-matching address, an attacker can supply a DNS response containing both a loopback IP and a non-loopback attacker IP. This causes Docker Engine to disable certificate verification and fall back to HTTP, exposing the registry connection to potential interception or manipulation.

This vulnerability allows an attacker to bypass TLS certificate verification for Docker registry connections, potentially enabling man-in-the-middle attacks or interception of sensitive data transmitted during image pulls or pushes. The fallback to HTTP further weakens the security of the connection, increasing the risk of data exposure or tampering.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious when configuring insecure registries and monitor Docker advisories for updates addressing this issue.