CVE-2026-41567 Moby CVE debrief

Who should care

Container administrators and users who use Moby installations should verify and update their installations to prevent potential arbitrary code execution. This includes operators, platform administrators, vulnerability-management teams, and security teams who need to ensure that their Moby installations are updated to Docker Engine 29.5.1 or moby/moby v2.0.0-beta.14. Additionally, users who upload compressed archives into containers or pipe compressed data,

Why it matters

CVE-2026-41567 is a high-severity vulnerability in the Moby container framework that allows arbitrary code execution with full daemon privileges. Container administrators and users should verify and update their Moby installations to prevent potential exploitation.

• Potential arbitrary code execution with full daemon privileges
• Possible host root UID and unrestricted capabilities exploitation
• Need for verification of Moby installations and updates to Docker Engine 29.5.1 or moby/moby v2.0.0-beta.14
• Importance of running containers from trusted images and restricting access to the PUT /containers/{id}/archive endpoint

Technical summary

The Moby container framework is vulnerable to arbitrary code execution when a compressed archive is uploaded to a container via PUT /containers/{id}/archive or piped through docker cp -. A malicious container image containing a trojanized decompression binary can achieve this. The issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. The vulnerability allows for potential arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities exploitation. Container administrators and users should verify and update their Moby installations to prevent potential exploitation.

Defensive priority

High priority for container administrators and users to verify and update their Moby installations.

Recommended defensive actions

• Verify and update Moby installations to Docker Engine 29.5.1 or moby/moby v2.0.0-beta.14
• Only run containers from trusted images
• Use authorization plugins to restrict access to the PUT /containers/{id}/archive endpoint
• Avoid piping compressed archives into containers created from untrusted images
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the PUT /containers/{id}/archive endpoint, and avoiding piping compressed archives into containers created from untrusted images.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.