CVE-2026-42306 is a race condition vulnerability in the Moby container framework affecting Red Hat Multicluster Global Hub. During the docker cp mount setup, a time-of-check to time-of-use (TOCTOU) race condition allows a malicious container to redirect a bind mount target to an arbitrary path on the host system. This can result in arbitrary host file overwrites, leading to data corruption or denial of service. Exploitation requires control over a running container. The vulnerability is rated critical by Red Hat Product Security with a CVSS v3 base score of 7.2 (Red Hat rating). No patch or official fix is currently available that meets Red Hat’s criteria for ease of use, applicability, or stability. The advisory references CWE-367 (TOCTOU race condition), CWE-190, and CWE-290. Red Hat continues to investigate and may release fixes in the future.

An attacker with control over a running container can exploit this race condition to overwrite arbitrary files on the host system. This can lead to data corruption or denial of service conditions on the host. The integrity and availability of the host system are impacted. Confidentiality is not affected. The vulnerability requires local access with low privileges but high attack complexity due to the race condition. No known exploits in the wild have been reported.

Currently, no official fix or patch is available that meets Red Hat's criteria for deployment and stability. Mitigation options are either unavailable or insufficient. Users should follow Red Hat advisories for updates and consider restricting container privileges and access as a precaution. Customers with Red Hat Technical Account Managers (TAM) can consult them for tailored guidance. Monitoring for future patches or updates from Red Hat is recommended.