CVE-2026-42306 Details
Description
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.
A race condition vulnerability has been identified in Moby and Docker Engine that allows a malicious container to redirect a bind mount target to an arbitrary path on the host. This issue arises during the setup of volume mounts when files are copied into a container. The vulnerability is present in Docker Engine versions prior to 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon versions prior to 2.0.0-beta.14. The vulnerability could lead to overwriting host files or causing a denial-of-service condition by masking a host path with a volume mount.
Users can update to Docker Engine version 29.5.1 or Moby Daemon version 2.0.0-beta.14, both of which include the patch for this vulnerability. For Docker Daemon users, no version is specified as patched, but upgrading to a version beyond 28.5.2 is recommended.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
| CWE-61 | UNIX Symbolic Link (Symlink) Following | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| docker engine | < 29.5.1 |
CPE
Remediation
| |
| mobyproject moby | <= 28.5.2 |
CPE
Remediation
| |
| mobyproject moby/v2 | 2.0.0 beta0 2.0.0 beta1 2.0.0 beta10 2.0.0 beta11 2.0.0 beta12 2.0.0 beta13 2.0.0 beta2 2.0.0 beta3 2.0.0 beta4 2.0.0 beta5 2.0.0 beta6 2.0.0 beta7 2.0.0 beta8 2.0.0 beta9 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 16, 2026 | Initial Analysis | [email protected] |
| Jun 12, 2026 | New CVE Received | [email protected] |