Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access
Summary: Docker Engine carries a high-severity flaw, CVE-2026-34040 (CVSS 8.8), that lets a specially crafted API request reach an authorization plugin without its body, so the plugin may approve a request it would otherwise deny. The bug is an incomplete fix for CVE-2024-41110, was independently reported by Asim Viladi Oglu Manizada, Cody, Oleh Konko, and Vladimir Tokarev, and is patched in Docker Engine 29.3.1.
Why it matters: Researcher Tokarev's report shows a single container-creation request padded past 1MB is dropped before the AuthZ plugin sees it, and the daemon then builds a privileged container with root access to the host - AWS credentials, SSH keys, and Kubernetes configs included - against every AuthZ plugin in the ecosystem.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-41110CVE-2026-34040
- Related
- ⚡ Weekly Recap: Fiber Optic Spying, Windows Rootkit, AI Vulnerability Hunting and More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026