CVE-2026-41568Low· 3.9▾ SunlitA flaw was found in the Moby container framework. A race condition during the `docker cp` mount setup allows a malicious container to create empty files or directories at arbitrary locations on the host filesystem. This vulnerability can l…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 21.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.1%
Last analysed / modified upstream
— → 3.9
none → low
A flaw was found in the Moby container framework. A race condition during the docker cp mount setup allows a malicious container to create empty files or directories at arbitrary locations on the host filesystem. This vulnerability can lead to a denial of service by filling up disk space or interfering with critical system files.
github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup — rated Low by Red Hat. Released 2026-06-12, updated 2026-10-09.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.22/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf https://access.redhat.com/errata/RHSA-2026:37387
Workarounds / mitigations:
Affected packages:
github.com/docker/dockergithub.com/moby/mobygithub.com/moby/moby/v2 < 2.0.0-beta.14Patched in:
github.com/moby/moby/v2 2.0.0-beta.14Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-22772Medium· 5.8fulcio: Fulcio: Server-Side Request Forgery (SSRF) via unanchored regex in MetaIssuer URL validation (CVE-2026-22772)
CVE-2026-33748Medium· 6.5github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components (CVE-2026-33748)
CVE-2026-24117Medium· 5.3github.com/sigstore/rekor: Rekor Server-Side Request Forgery (SSRF) (CVE-2026-24117)
CVE-2026-33747High· 8.2BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend (CVE-2026-33747)
CVE-2026-25934Medium· 4.3go-git/go-git: go-git: Data integrity issue due to improper verification of pack and index files (CVE-2026-25934)
CVE-2024-40635Medium· 4.6containerd: containerd has an integer overflow in User ID handling (CVE-2024-40635)