Two related vulnerabilities (CVE-2026-41568 and CVE-2026-42306) exist in Docker Engine and Moby Daemon due to a race condition during the docker cp mount setup process. This race condition allows a malicious container to either create empty files or directories at arbitrary absolute paths on the host filesystem or to redirect a bind mount target to an arbitrary host path. The latter can lead to overwriting host files or causing denial of service. These vulnerabilities affect Docker Engine versions prior to 29.5.1, Docker Daemon versions 28.5.2 and earlier, and Moby Daemon versions prior to 2.0.0-beta.14. Both issues have been addressed and patched in Docker Engine 29.5.1 and Moby Daemon 2.0.0-beta.14.

Exploitation of these vulnerabilities allows a malicious container to manipulate the host filesystem by creating files or directories at arbitrary absolute paths or redirecting bind mount targets to arbitrary host paths. This can lead to integrity violations by overwriting host files and availability issues through denial of service. Confidentiality impact is not indicated. The CVSS score of 7.2 reflects high severity with local attack vector, high attack complexity, low privileges required, user interaction required, scope changed, no confidentiality impact, high integrity impact, and high availability impact.

A patch is available and should be applied. Users should upgrade Docker Engine to version 29.5.1 or later and Moby Daemon to version 2.0.0-beta.14 or later to remediate these vulnerabilities. No additional mitigation steps are indicated by the vendor advisory.