CVE-2026-41567 Details

A vulnerability in Moby Docker Engine in versions prior to 29.5.1 and in the v2 series prior to v2.0.0-beta.14 allows for arbitrary code execution with full daemon privileges. This issue arises when a compressed archive is uploaded to a container using the 'PUT /containers/{id}/archive' API or through 'docker cp -'. The daemon incorrectly resolves decompression binaries from the container's filesystem instead of the host's, due to a flaw in the operation order. As a result, a malicious container image containing a trojanized decompression binary can execute arbitrary code with the daemon's privileges, including host root access and unrestricted capabilities.

Users can upgrade to Docker Engine version 29.5.1 or Moby/Moby v2.0.0-beta.14. Additionally, it is recommended to only run containers from trusted images, use authorization plugins to restrict access to the 'PUT /containers/{id}/archive' endpoint, and avoid piping compressed archives into containers created from untrusted images.