--- id: CVE-2026-41568 title: >- github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup (CVE-2026-41568) summary: >- A flaw was found in the Moby container framework. A race condition during the `docker cp` mount setup allows a malicious container to create empty files or directories at arbitrary locations on the host filesystem. This vulnerability can l… severity: low cvss: 3.9 cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L' cvssSource: vendor cwe: CWE-367 vendor: Red Hat product: Red Hat Openshift Data Foundation 4.22 affected: - assisted_installer_for_red_hat_openshift_container_platform 2 - confidential_compute_attestation - gatekeeper 3 - kernel_module_management_operator_for_red_hat_openshift - logging_subsystem_for_red_hat_openshift - logical_volume_manager_storage - machine_deletion_remediation_operator - migration_toolkit_for_containers - migration_toolkit_for_virtualization - multiarch_tuning_operator - multicluster_engine_for_kubernetes - multicluster_global_hub - node_healthcheck_operator - openshift_api_for_data_protection - openshift_developer_tools_and_services - openshift_lightspeed - openshift_pipelines - openshift_serverless - openshift_service_mesh 2 - openshift_service_mesh 3 - openshift_source_to_image_s2i - pen_drive_powered_by_red_hat_lightspeed - power_monitoring_for_red_hat_openshift - advanced_cluster_management_for_kubernetes 2 - advanced_cluster_security 4 - ansible_automation_platform 2 - build_of_kueue - build_of_podman_desktop_tech_preview - ceph_storage 5 - ceph_storage 6 - ceph_storage 7 - ceph_storage 8 - ceph_storage 9 - edge_manager 1 - enterprise_linux 10 - enterprise_linux 8 - enterprise_linux 9 - openshift_ai_rhoai - openshift_container_platform 4 - openshift_dev_spaces patched: - openshift_data_foundation 4.22 published: '2026-06-12' updated: '2026-10-09' sourceUpdated: '2026-10-09T04:23:07+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41568.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41568.json - url: 'https://access.redhat.com/security/cve/CVE-2026-41568' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2488493' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-41568' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-41568' - url: 'https://github.com/moby/moby/security/advisories/GHSA-vp62-88p7-qqf5' - url: 'https://access.redhat.com/errata/RHSA-2026:37387' tags: - csaf - vex - red-hat - osv - go epss: 0.00108 epssPercentile: 0.01194 aliases: - GO-2026-5668 - GHSA-vp62-88p7-qqf5 ecosystem: go ingestedAt: '2026-08-12T19:18:08.821Z' --- ## Overview A flaw was found in the Moby container framework. A race condition during the `docker cp` mount setup allows a malicious container to create empty files or directories at arbitrary locations on the host filesystem. This vulnerability can lead to a denial of service by filling up disk space or interfering with critical system files. ## Vendor advisories - **RHSA-2026:37387** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.22 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37387) - **Red Hat VEX** · Low · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Confidential Compute Attestation, Gatekeeper 3, Kernel Module Management Operator for Red Hat Openshift, Logging Subsystem for Red Hat OpenShift, Logical Volume Manager Storage, … · no fix planned: Assisted Installer for Red Hat OpenShift Container Platform 2, Confidential Compute Attestation, Gatekeeper 3, Kernel Module Management Operator for Red Hat Openshift, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41568.json) **github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup** — rated Low by Red Hat. Released 2026-06-12, updated 2026-10-09. Affected: - Assisted Installer for Red Hat OpenShift Container Platform 2 - Confidential Compute Attestation - Gatekeeper 3 - Kernel Module Management Operator for Red Hat Openshift - Logging Subsystem for Red Hat OpenShift - Logical Volume Manager Storage - Machine Deletion Remediation Operator - Migration Toolkit for Containers - Migration Toolkit for Virtualization - Multiarch Tuning Operator - Multicluster Engine for Kubernetes - Multicluster Global Hub - Node HealthCheck Operator - OpenShift API for Data Protection - OpenShift Developer Tools and Services - OpenShift Lightspeed - OpenShift Pipelines - OpenShift Serverless - OpenShift Service Mesh 2 - OpenShift Service Mesh 3 - OpenShift Source-to-Image (S2I) - Pen Drive Powered by Red Hat Lightspeed - Power monitoring for Red Hat OpenShift - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat Advanced Cluster Security 4 - Red Hat Ansible Automation Platform 2 - Red Hat Build of Kueue - Red Hat Build of Podman Desktop - Tech Preview - Red Hat Ceph Storage 5 - Red Hat Ceph Storage 6 - Red Hat Ceph Storage 7 - Red Hat Ceph Storage 8 - Red Hat Ceph Storage 9 - Red Hat Edge Manager 1 - Red Hat Enterprise Linux 10 - Red Hat Enterprise Linux 8 - Red Hat Enterprise Linux 9 - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift Dev Spaces Fixed: - Red Hat Openshift Data Foundation 4.22 No fix planned: - Assisted Installer for Red Hat OpenShift Container Platform 2 - Confidential Compute Attestation - Gatekeeper 3 - Kernel Module Management Operator for Red Hat Openshift - Logging Subsystem for Red Hat OpenShift - Logical Volume Manager Storage - Machine Deletion Remediation Operator - Migration Toolkit for Containers - Migration Toolkit for Virtualization - Multiarch Tuning Operator - Multicluster Engine for Kubernetes - Multicluster Global Hub - Node HealthCheck Operator - OpenShift API for Data Protection - OpenShift Developer Tools and Services - OpenShift Lightspeed - OpenShift Pipelines - OpenShift Serverless - OpenShift Service Mesh 2 - OpenShift Service Mesh 3 - OpenShift Source-to-Image (S2I) - Pen Drive Powered by Red Hat Lightspeed - Power monitoring for Red Hat OpenShift - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat Advanced Cluster Security 4 - Red Hat Ansible Automation Platform 2 - Red Hat Build of Kueue - Red Hat Build of Podman Desktop - Tech Preview - Red Hat Ceph Storage 5 - Red Hat Ceph Storage 6 - Red Hat Ceph Storage 7 - Red Hat Ceph Storage 8 - Red Hat Ceph Storage 9 - Red Hat Edge Manager 1 - Red Hat Enterprise Linux 10 - Red Hat Enterprise Linux 8 - Red Hat Enterprise Linux 9 - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift Dev Spaces Not affected: - Red Hat Openshift Data Foundation 4.22 - Red Hat Hardened Images ## Remediation Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.22/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf https://access.redhat.com/errata/RHSA-2026:37387 Workarounds / mitigations: - Avoid using docker cp with untrusted running containers. Recommended to apply patches: Mountpoint creation is now scoped to the container root using os.Root (Go 1.24+), which refuses to follow symlinks that escape the opened root directory. All filesystem operations in createIfNotExists (MkdirAll, OpenFile) are performed through the os.Root handle, so even if a symlink swap occurs after path resolution, the creation stays confined to the container root. ## Package advisory (CVE-2026-41568) Affected packages: - `github.com/docker/docker` - `github.com/moby/moby` - `github.com/moby/moby/v2 < 2.0.0-beta.14` Patched in: - `github.com/moby/moby/v2 2.0.0-beta.14` Source: https://osv.dev/vulnerability/GO-2026-5668