The update fixes four vulnerabilities in docker-stable related to the BuildKit component and plugin privilege validation. CVE-2026-33747 allows malicious frontends to craft API messages that cause files to be written outside the BuildKit state directory. CVE-2026-33748 involves insufficient validation of Git URL fragment subdirectory components, potentially allowing access to files outside the checked-out Git repository. CVE-2026-33997 addresses a privilege validation bypass during plugin operations. CVE-2026-34040 fixes an authorization regression involving zero-length checks. These issues could lead to unauthorized file writes and privilege escalation within the affected docker-stable environment.

Successful exploitation of these vulnerabilities could allow attackers to write files outside intended directories, access unauthorized files in Git repositories, bypass privilege checks during plugin operations, and exploit authorization regressions. This could lead to unauthorized code execution, privilege escalation, or unauthorized access to sensitive files within the docker-stable environment.

A security update for docker-stable has been released by the SUSE Product Security Team addressing these vulnerabilities. Users should apply the official update SUSE-SU-2026:2578-1 to remediate these issues. Patch status is confirmed by the vendor advisory. No additional mitigation steps are specified beyond applying the update.