CVE-2026-92542 Docker CVE debrief

Who should care

Docker Engine administrators and users, especially those utilizing overlay networks, should assess exposure and implement necessary updates or mitigations. The vulnerability poses a medium risk due to its potential for unauthorized network access and disruption. Docker Engine administrators and users should verify current network configurations and firewall rules, and update Docker Engine to prevent exploitation.

Why it matters

This vulnerability in Docker Engine poses a medium risk due to its potential for unauthorized network access and disruption. Docker Engine administrators and users, especially those utilizing overlay networks, should assess their exposure and implement necessary updates or mitigations. The issue requires verification of current network configurations and firewall rules, and updates to Docker Engine to prevent exploitation.

• Potential unauthorized access to sensitive network resources.
• Possible disruption of network services due to injected malicious traffic.
• Need for verification of current network configurations and firewall rules.
• Requirement for updates to Docker Engine to prevent exploitation.

Technical summary

The vulnerability allows for blind VXLAN injection into encrypted overlay networks from a cluster peer due to improper handling of firewall rules for VXLAN datagrams. This issue arises from firewall rules that indiscriminately match both authentic and forged VXLAN datagrams for encryption. The vulnerability has a medium CVSS score of 6.9 and is considered a medium priority for defensive actions. The issue requires verification of current network configurations and firewall rules, and updates to Docker Engine to prevent exploitation.

Defensive priority

Medium priority for defensive actions due to the potential for unauthorized network access.

Recommended defensive actions

• Review and update Docker Engine to version 25.0.19 or later, or 29.8.2 or later.
• Implement additional monitoring for suspicious network activity.
• Restrict access to sensitive networks and resources.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is confirmed in Docker Engine versions prior to 25.0.19 and 29.8.2. Official sources indicate that the issue lies in the overlay network driver. The CVE record was published on 2026-10-07T16:42:20.998Z and has not been modified since then. The vulnerability allows for unauthorized network access and disruption, posing a medium risk. Docker Engine administrators and users should verify current network configurations and firewall rules, and update Docker Engine to prevent exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.