CVE-2025-54410 Details

A vulnerability in Moby, affecting releases prior to 28.0.0, disrupts network segmentation between containers across different bridge networks. When firewalld is reloaded, Docker fails to restore iptables rules that isolate bridge networks, allowing containers to access all ports on other containers within non-internal bridge networks on the same host. This issue poses a significant risk in multi-tenant environments, although containers in --internal networks remain protected. The vulnerability arises because Docker does not re-establish the necessary isolation rules after firewalld is reloaded, leaving containers exposed to each other. Workarounds include reloading firewalld and restarting the Docker daemon, recreating bridge networks, or using rootless mode.

Users can upgrade to Moby version 25.0.13 or later, where this vulnerability is patched. After reloading firewalld, the Docker daemon can be restarted, bridge networks can be recreated, or rootless mode can be used.