CVE-2026-34040

Description

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

CVSS Metrics

• v3.1•HIGH•Score: 8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• v3.1•HIGH•Score: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 9.11%• Percentile: 95%

Techniques & Countermeasures

• CWE-288•Authentication Bypass Using an Alternate Path or Channel

  The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Affected Systems

• chainguard•agentbeat

  all

• chainguard•agentbeat-fips

  all

• chainguard•amazon-cloudwatch-agent

  all

• chainguard•amazon-cloudwatch-agent-fips

  all

• chainguard•amazon-cloudwatch-agent-operator

  < 3.6.0-r0

• chainguard•amazon-cloudwatch-agent-operator-fips

  < 3.6.0-r0

• chainguard•amazon-ecs-agent

  all

• chainguard•amazon-ecs-agent-fips

  all

• chainguard•apko

  < 1.2.0-r0

• chainguard•auditbeat-8.17

  all

• chainguard•auditbeat-8.18

  all

• chainguard•auditbeat-8.19

  < 8.19.17-r0

• chainguard•auditbeat-9.0

  all

• chainguard•auditbeat-9.1

  all

• chainguard•auditbeat-9.2

  all

• chainguard•auditbeat-9.3

  < 9.3.6-r0

• chainguard•auditbeat-9.4

  < 9.4.3-r0

• chainguard•auditbeat-fips-8.17

  all

• chainguard•auditbeat-fips-8.18

  all

• chainguard•auditbeat-fips-8.19

  < 8.19.17-r0

• chainguard•auditbeat-fips-9.0

  all

• chainguard•auditbeat-fips-9.1

  all

• chainguard•auditbeat-fips-9.2

  all

• chainguard•auditbeat-fips-9.3

  < 9.3.6-r0

• chainguard•auditbeat-fips-9.4

  < 9.4.3-r0

• chainguard•aws-otel-collector

  < 0.48.0-r0

• chainguard•aws-otel-collector-fips

  < 0.48.0-r0

• chainguard•buf

  < 1.68.3-r0

• chainguard•buildah

  < 1.44.0-r0

• chainguard•buildah-fips

  < 1.44.0-r0

• chainguard•cg

  < 0.2.235-r0 | < 0.2.231-r0

• chainguard•chainctl

  all

• chainguard•chainctl-fips

  all

• chainguard•chainloop-control-plane

  < 1.100.8-r0

• chainguard•chainloop-control-plane-fips

  < 1.100.8-r0

• chainguard•chaos-mesh

  all

• chainguard•chaos-mesh-daemon

  all

• chainguard•chaos-mesh-dashboard

  all

• chainguard•chaos-mesh-fips

  all

• chainguard•chaos-mesh-fips-daemon

  all

• chainguard•chaos-mesh-fips-dashboard

  all

• chainguard•cloudbeat-8.17

  all

• chainguard•cloudbeat-8.18

  all

• chainguard•cloudbeat-8.19

  all

• chainguard•cloudbeat-9.0

  all

• chainguard•cloudbeat-9.1

  all

• chainguard•cloudbeat-9.2

  all

• chainguard•cloudbeat-9.3

  < 9.3.8-r0

• chainguard•cloudbeat-9.4

  < 9.4.4-r0

• chainguard•cloudbeat-fips-8.17

  all

Showing first 50 affected entries in server-rendered view.

References (9)

• https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq
• https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2
• https://github.com/moby/moby/commit/e89edb19ad7de0407a5d31e3111cb01aa10b5a38
• https://docs.docker.com/engine/extend/plugins_authorization
• https://github.com/moby/moby
• https://github.com/moby/moby/releases/tag/docker-v29.3.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-34040
• https://security-tracker.debian.org/tracker/CVE-2026-34040
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34040.json