Threats affecting pkg:github/github.com/moby/swarmkit/v2

CVE-2026-115538 is a vulnerability in Moby's overlay network driver where iptables rules for encrypted overlay networks are not restored after firewalld deletes them. This causes outgoing VXLAN datagrams to bypass IPsec encryption, exposing traffic to potential interception. The issue persists until the encrypted network's last local endpoint is removed and another is added, or dockerd is restarted. The flaw is not logged by dockerd and recurs with each firewalld event.

CVE-2026-115539 is a high-severity vulnerability in moby SwarmKit's Cluster-API proxy where an attacker with a valid worker node TLS certificate can escalate privileges to a manager node. This occurs due to the proxy overwriting a forwarded client's TLS identity with an intermediary manager's identity during a short window after a leader change, specifically when built with grpc-go 1.39 or later. The flaw allows privilege escalation from worker to manager by obtaining a manager node certificate for the attacker's key. The issue affects SwarmKit versions prior to 2.1.3.

Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Because the transport re-dials the hostname rather than the CIDR-matching address, a DNS answer set of one loopback IP plus a non-loopback attacker IP disables certificate verification and enables HTTP fallback for the registry connection.

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.