PatchSiren cyber security CVE debrief
CVE-2026-33997 moby CVE debrief
CVE-2026-33997 is a security vulnerability in Moby, an open-source container framework. Prior to version 29.3.1, the vulnerability allows plugins privilege validation to be bypassed during Docker plugin installation. The issue arises from an error in the daemon's privilege comparison logic, which may incorrectly accept a privilege set that differs from the one approved by the user. This affects plugins that request more than one privilege and those that request exactly one privilege, as no comparison is performed in the latter case. The vulnerability has been patched in version 29.3.1.
- Vendor
- moby
- Product
- Unknown
- CVSS
- MEDIUM 6.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-03-31
- Original CVE updated
- 2026-06-16
- Advisory published
- 2026-03-31
- Advisory updated
- 2026-06-16
Who should care
Users of Moby (Docker Engine) versions prior to 29.3.1 who install plugins should be aware of this vulnerability. Specifically, those who install plugins that request privileges should ensure they are using version 29.3.1 or later to avoid potential privilege escalation issues.
Technical summary
The vulnerability is caused by flawed privilege comparison logic in the daemon. This logic error allows for the bypass of privilege validation during the installation of Docker plugins. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 6.8, indicating a medium severity level. The CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N.
Defensive priority
Medium
Recommended defensive actions
- Update Moby (Docker Engine) to version 29.3.1 or later to patch the vulnerability.
- Review and validate the privileges of installed plugins to ensure they align with the intended functionality and user approval.
Evidence notes
The vulnerability was patched in version 29.3.1 of Moby (Docker Engine). References to the patch and advisory can be found at [ref-4](https://github.com/moby/moby/releases/tag/docker-v29.3.1) and [ref-5](https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9).
Official resources
-
CVE-2026-33997 CVE record
CVE.org
-
CVE-2026-33997 NVD detail
NVD
-
Source item URL
nvd_modified
-
Mitigation or vendor reference
[email protected] - Release Notes
-
Mitigation or vendor reference
[email protected] - Vendor Advisory
CVE-2026-33997 was published on 2026-03-31T03:15:57.523Z and modified on 2026-06-16T14:47:38.807Z.