CVE-2026-42306
High
Description
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.
SeverityHigh
CVSS7.2
Exploit probability—
Product
Docker Engine
PublishedJun 12, 2026
First seenJun 12, 2026
Weakness typeCWE-61CWE-61CWE-367CWE-367
How to fix
Update
- docker engine29.5.1 or later
- github.com/moby/moby/v22.0.0-beta.14 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| docker engine | v < 29.5.1 | 29.5.1 |
| mobyproject moby | v ≤ 28.5.2 | — |
| mobyproject moby\/v2 | 2.0.0 | — |
| github.com/docker/dockerGo | v ≤ 28.5.2, No range specified | — |
| github.com/moby/moby/v2Go | v < 2.0.0-beta.14 | 2.0.0-beta.14 |
| github.com/moby/mobyGo | v ≤ 28.5.2, No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.