CVE-2026-41567

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 7.2EPSS <1%

Published 2026-06-05Updated 2026-08-24

PoC

Vulnerability details

Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

CNAGitHub_M

EPSS score history

Sources

3 links

PoC links are not available for guest users. Login to view them.

GitHub Security Advisories CVE Organization RedHat Vuln DB

Profile

CVSS

7.2

EPSS

<1%

Published

2026-06-05

Updated

2026-08-24

CNA

GitHub_M

Vendors

No vendors listed.

CPEs

cpe:/a:redhat:exploit_intelligence:0

cpe:/a:redhat:multicluster_engine

cpe:/a:redhat:openshift_lightspeed

cpe:/a:redhat:source_to_image:1

cpe:/a:redhat:acm:2

cpe:/a:redhat:ceph_storage:5

cpe:/a:redhat:ceph_storage:7

cpe:/a:redhat:ceph_storage:8

cpe:/a:redhat:ceph_storage:9

cpe:/o:redhat:enterprise_linux:10

cpe:/o:redhat:enterprise_linux:9

cpe:/a:redhat:hummingbird:1

cpe:/a:redhat:openshift_ai

cpe:/a:redhat:openshift:4

cpe:/a:redhat:openshift_distributed_tracing:3

cpe:/a:redhat:multicluster_globalhub

cpe:/a:redhat:openshift_data_foundation:4.22::el9

cpe:/a:redhat:multicluster_globalhub:1.4::el9

cpe:/a:redhat:multicluster_globalhub:1.5::el9

cpe:/a:redhat:multicluster_globalhub:1.6::el9

cpe:/a:redhat:source_to_image:1.6::el8

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated