Threats affecting pkg:github/github.com/docker/docker

CVE-2026-115539 is a high-severity vulnerability in moby SwarmKit's Cluster-API proxy where an attacker with a valid worker node TLS certificate can escalate privileges to a manager node. This occurs due to the proxy overwriting a forwarded client's TLS identity with an intermediary manager's identity during a short window after a leader change, specifically when built with grpc-go 1.39 or later. The flaw allows privilege escalation from worker to manager by obtaining a manager node certificate for the attacker's key. The issue affects SwarmKit versions prior to 2.1.3.