CVE-2026-34040

8.8 HIGH

Moby is an open source container framework

Published: 2026-03-31 · Last updated: 2026-06-16

Severity and scoring

CVSS: 8.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE: CWE-288

Affected products

Vendor	Product
docker	engine

Description

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-34040
[Other]https://github.com/moby/moby/releases/tag/docker-v29.3.1
[Vendor advisory]https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2

Related CVEs

Same vendor

CVE-2026-42306 — Moby is an open source container framework (7.2 HIGH)
CVE-2026-41568 — Moby is an open source container framework (6.1 MEDIUM)
CVE-2026-5843 — The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary P... (8.2 HIGH)
CVE-2026-5817 — The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizer... (8.2 HIGH)
CVE-2026-6406 — The Docker CLI --use-api-socket flag bypasses Enhanced Container Isolation (ECI) restrictions in Docker Desktop (8.8 HIGH)

Same CWE

CVE-2026-12225 — syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitbucket 3.4.0.x contains an authentication bypass vulnerability
CVE-2026-49764 — Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions (9.8 CRITICAL)
CVE-2026-48970 — Unauthenticated Broken Authentication in Really Simple SSL <= 9.5.10 versions (8.1 HIGH)
CVE-2026-42668 — Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1.18.0 versions (7.5 HIGH)
CVE-2026-42411 — Unauthenticated Broken Authentication in CloudSecure WP Security <= 1.4.7 versions (8.1 HIGH)