CVE-2026-42306 is a race condition vulnerability in the Moby container framework's docker cp mount setup process. A malicious container can exploit this flaw to redirect a bind mount target to any path on the host, enabling overwriting of arbitrary host files. Exploitation requires control over a running container. The vulnerability impacts integrity by allowing unauthorized modification of host files, potentially causing data corruption or denial of service. Red Hat has rated this issue as critical with a CVSS v3 base score of 7.2 (Red Hat scoring). No effective mitigation or patch is currently available that meets Red Hat's standards for ease of use, applicability, and stability.

An attacker with control over a running container can exploit this race condition to overwrite arbitrary files on the host system. This can lead to data corruption or denial of service conditions on the host. The vulnerability affects the integrity and availability of the host system. Confidentiality is not impacted. The flaw requires local access to a container and high attack complexity.

Currently, no mitigation or patch meeting Red Hat Product Security criteria for ease of deployment, applicability, and stability is available. Users should monitor Red Hat advisories for future updates. Exploitation requires control over a running container, so restricting container access and privileges may reduce risk. Customers with Red Hat Technical Account Managers can seek guidance directly. Upgrading to a fixed version when available is recommended.