CVE-2026-34040: Moby: AuthZ plugin bypass with oversized request body

Analyzed

AliasesUBUNTU-CVE-2026-34040DEBIAN-CVE-2026-34040CGA-22mg-cr4f-6hww+1396 more

Published 31-03-2026Last modified 02-04-2026

Vulnerability summary

CVE-2026-34040 is a high (CVSS 8.8) vulnerability in docker engine. EPSS estimates a 9.27% chance of exploitation in the next 30 days, higher than 95.3% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 8.8, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

8.8/10

010

High · v3.1 (CVE.org)

EPSS score

9.27%

0%100%

Low · +9.11 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 7

OPENSUSE-SU-2026:11075-1 OPENSUSE-SU-2026:21205-1 OPENSUSE-SU-2026:21483-1 SUSE-SU-2026:1205-1 SUSE-SU-2026:2578-1 SUSE-SU-2026:2579-1+1 more

Timeline

31-03-2026
PublishedVulnerability first disclosed.
02-04-2026
Last modifiedVulnerability information updated.

Description

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

CVSS metrics

8 scores · 8 sources · 1 version

v3.18.8

EPSS trend

Probability

9.27%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

Increase +9.11 pp

From 0.16% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-288Authentication Bypass Using an Alternate Path or ChannelThe product requires authentication, but the product has an alternate path or channel that does not require authentication.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

agentbeatAll versions (No fix recorded)
agentbeat-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent< 1.300074.0-r0
amazon-cloudwatch-agent-fips< 1.300074.0-r0
amazon-cloudwatch-agent-operator< 3.6.0-r0

amazon-cloudwatch-agent-operator-fips< 3.6.0-r0
amazon-ecs-agentAll versions (No fix recorded)
amazon-ecs-agent-fipsAll versions (No fix recorded)
apko< 1.2.0-r0
auditbeat-8.17All versions (No fix recorded)
auditbeat-8.18All versions (No fix recorded)
auditbeat-8.19< 8.19.17-r0
auditbeat-9.0All versions (No fix recorded)
auditbeat-9.1All versions (No fix recorded)
auditbeat-9.2All versions (No fix recorded)
auditbeat-9.3< 9.3.6-r0
auditbeat-9.4< 9.4.3-r0
auditbeat-fips-8.17All versions (No fix recorded)
auditbeat-fips-8.18All versions (No fix recorded)
auditbeat-fips-8.19< 8.19.17-r0
auditbeat-fips-9.0All versions (No fix recorded)
auditbeat-fips-9.1All versions (No fix recorded)
auditbeat-fips-9.2All versions (No fix recorded)
auditbeat-fips-9.3< 9.3.6-r0
auditbeat-fips-9.4< 9.4.3-r0
aws-otel-collector< 0.48.0-r0
aws-otel-collector-fips< 0.48.0-r0
buf< 1.68.3-r0
buildah< 1.44.0-r0
buildah-fips< 1.44.0-r0
cg< 0.2.235-r0 | < 0.2.231-r0
chainctlAll versions (No fix recorded)
chainctl-fipsAll versions (No fix recorded)
chainloop-control-plane< 1.100.8-r0
chainloop-control-plane-fips< 1.100.8-r0
chaos-meshAll versions (No fix recorded) | < 2.8.7-r0
chaos-mesh-daemonAll versions (No fix recorded) | < 2.8.7-r0
chaos-mesh-dashboardAll versions (No fix recorded) | < 2.8.7-r0
chaos-mesh-fipsAll versions (No fix recorded) | < 2.8.7-r0
chaos-mesh-fips-daemonAll versions (No fix recorded) | < 2.8.7-r0
chaos-mesh-fips-dashboardAll versions (No fix recorded) | < 2.8.7-r0
cloudbeat-8.17All versions (No fix recorded)
cloudbeat-8.18All versions (No fix recorded)
cloudbeat-8.19< 8.19.23-r0
cloudbeat-9.0All versions (No fix recorded)
cloudbeat-9.1All versions (No fix recorded)
cloudbeat-9.2All versions (No fix recorded)
cloudbeat-9.3< 9.3.8-r0
cloudbeat-9.4< 9.4.4-r0
cloudbeat-fips-8.17All versions (No fix recorded)
cloudbeat-fips-8.18All versions (No fix recorded)
cloudbeat-fips-8.19< 8.19.23-r0
cloudbeat-fips-9.0All versions (No fix recorded)
cloudbeat-fips-9.1All versions (No fix recorded)
cloudbeat-fips-9.2All versions (No fix recorded)
cloudbeat-fips-9.3< 9.3.8-r0
cloudbeat-fips-9.4< 9.4.4-r0
cluster-api-1.10-capd-managerAll versions (No fix recorded)
cluster-api-1.11-capd-manager< 1.11.8-r0
cluster-api-1.12-capd-manager< 1.12.5-r0
cluster-api-1.8-capd-managerAll versions (No fix recorded)
cluster-api-1.9-capd-managerAll versions (No fix recorded)
cluster-api-fips-1.10-capd-managerAll versions (No fix recorded)
cluster-api-fips-1.11-capd-manager< 1.11.8-r0
cluster-api-fips-1.12-capd-manager< 1.12.5-r0
cluster-api-fips-1.8-capd-managerAll versions (No fix recorded)
cluster-api-fips-1.9-capd-managerAll versions (No fix recorded)
commercial-chainloop-backendAll versions (No fix recorded)
commercial-gitlab-rails-ee-19.1All versions (No fix recorded)
commercial-gitlab-rails-ee-19.2All versions (No fix recorded)
commercial-gitlab-rails-ee-19.3All versions (No fix recorded)
commercial-gitlab-rails-ee-19.4All versions (No fix recorded)
commercial-gitlab-rails-ee-19.5All versions (No fix recorded)
commercial-gitlab-rails-ee-fips-19.1All versions (No fix recorded)
commercial-gitlab-rails-ee-fips-19.2All versions (No fix recorded)
commercial-gitlab-rails-ee-fips-19.3All versions (No fix recorded)
commercial-gitlab-rails-ee-fips-19.4All versions (No fix recorded)
commercial-gitlab-rails-ee-fips-19.5All versions (No fix recorded)
commercial-grafana-12.3< 12.3.8-r0
commercial-grafana-12.4< 12.4.5-r0
consul-k8s-fips-1.4-cli< 1.4.10-r25
cri-tools< 1.37.0-r0
crictl< 1.37.0-r0
crossplane-1.20-crankAll versions (No fix recorded)
crossplane-2.0-crankAll versions (No fix recorded)
crossplane-2.1-crankAll versions (No fix recorded)
crossplane-2.2-crankAll versions (No fix recorded)
crossplane-2.3-crankAll versions (No fix recorded)
crossplane-2.4-crankAll versions (No fix recorded)
crossplane-cli-2.3All versions (No fix recorded)
crossplane-cli-2.4All versions (No fix recorded)
crossplane-cli-fips-2.3All versions (No fix recorded)
crossplane-cli-fips-2.4All versions (No fix recorded)
crossplane-fips-1.20-crankAll versions (No fix recorded)
crossplane-fips-2.0-crankAll versions (No fix recorded)
crossplane-fips-2.1-crankAll versions (No fix recorded)
crossplane-fips-2.2-crankAll versions (No fix recorded)
crossplane-fips-2.3-crankAll versions (No fix recorded)
crossplane-fips-2.4-crankAll versions (No fix recorded)
crossplane-function-kclAll versions (No fix recorded)
crossplane-function-kcl-fipsAll versions (No fix recorded)
ctopAll versions (No fix recorded)
ctop-fipsAll versions (No fix recorded)
daggerAll versions (No fix recorded)
datadog-agent-7.71All versions (No fix recorded)
datadog-agent-7.71-fullAll versions (No fix recorded)
datadog-agent-7.72All versions (No fix recorded)
datadog-agent-7.72-fullAll versions (No fix recorded)
datadog-agent-7.73All versions (No fix recorded)
datadog-agent-7.73-fullAll versions (No fix recorded)
datadog-agent-7.74All versions (No fix recorded)
datadog-agent-7.74-fullAll versions (No fix recorded)
datadog-agent-7.75All versions (No fix recorded)
datadog-agent-7.75-fullAll versions (No fix recorded)
datadog-agent-7.76All versions (No fix recorded)
datadog-agent-7.76-fullAll versions (No fix recorded)
datadog-agent-7.77All versions (No fix recorded)
datadog-agent-7.77-full< 7.77.3-r10
datadog-agent-7.78All versions (No fix recorded)
datadog-agent-7.78-fullAll versions (No fix recorded)
datadog-agent-7.82All versions (No fix recorded)
datadog-agent-7.83All versions (No fix recorded)
datadog-agent-7.84All versions (No fix recorded)
datadog-agent-7.85All versions (No fix recorded)
datadog-agent-fips-7.71All versions (No fix recorded)
datadog-agent-fips-7.71-fullAll versions (No fix recorded)
datadog-agent-fips-7.72All versions (No fix recorded)
datadog-agent-fips-7.72-fullAll versions (No fix recorded)
datadog-agent-fips-7.73All versions (No fix recorded)
datadog-agent-fips-7.73-fullAll versions (No fix recorded)
datadog-agent-fips-7.74All versions (No fix recorded)
datadog-agent-fips-7.74-fullAll versions (No fix recorded)
datadog-agent-fips-7.75All versions (No fix recorded)
datadog-agent-fips-7.75-fullAll versions (No fix recorded)
datadog-agent-fips-7.76All versions (No fix recorded)
datadog-agent-fips-7.76-fullAll versions (No fix recorded)
datadog-agent-fips-7.77All versions (No fix recorded)
datadog-agent-fips-7.77-fullAll versions (No fix recorded)
datadog-agent-fips-7.78All versions (No fix recorded)
datadog-agent-fips-7.78-fullAll versions (No fix recorded)
datadog-agent-fips-7.82All versions (No fix recorded)
datadog-agent-fips-7.83All versions (No fix recorded)
datadog-agent-fips-7.84All versions (No fix recorded)
datadog-agent-fips-7.85All versions (No fix recorded)
datadog-cluster-agent-7.71All versions (No fix recorded)
datadog-cluster-agent-7.72All versions (No fix recorded)
datadog-cluster-agent-7.73All versions (No fix recorded)
datadog-cluster-agent-7.74All versions (No fix recorded)
datadog-cluster-agent-7.75All versions (No fix recorded)
datadog-cluster-agent-7.76All versions (No fix recorded)
datadog-cluster-agent-7.77All versions (No fix recorded)
datadog-cluster-agent-7.78All versions (No fix recorded)
datadog-cluster-agent-fips-7.71All versions (No fix recorded)
datadog-cluster-agent-fips-7.72All versions (No fix recorded)
datadog-cluster-agent-fips-7.73All versions (No fix recorded)
datadog-cluster-agent-fips-7.74All versions (No fix recorded)
datadog-cluster-agent-fips-7.75All versions (No fix recorded)
datadog-cluster-agent-fips-7.76All versions (No fix recorded)
datadog-cluster-agent-fips-7.77All versions (No fix recorded)
datadog-cluster-agent-fips-7.78All versions (No fix recorded)
diveAll versions (No fix recorded)
docker-cli-buildxAll versions (No fix recorded)
docker-cli-buildx-fipsAll versions (No fix recorded)
docker-composeAll versions (No fix recorded)
docker-compose-fips< 5.5.1-r0
docker-credential-gcr< 2.2.0-r0
docker-credential-gcr-fips< 2.2.0-r0
dockerd-28All versions (No fix recorded)
dockerd-29< 29.4.1-r0
dockerd-fips-28All versions (No fix recorded)
dockerd-fips-29< 29.5.2-r0
dogstatsd-7.71All versions (No fix recorded)
dogstatsd-7.72All versions (No fix recorded)
dogstatsd-7.73All versions (No fix recorded)
dogstatsd-7.74All versions (No fix recorded)
dogstatsd-7.75All versions (No fix recorded)
dogstatsd-7.76All versions (No fix recorded)
dogstatsd-7.77All versions (No fix recorded)
dogstatsd-7.78All versions (No fix recorded)
droneAll versions (No fix recorded)
drone-fipsAll versions (No fix recorded)
elastic-agent-8.17All versions (No fix recorded)
elastic-agent-8.18All versions (No fix recorded)
elastic-agent-8.19< 8.19.14-r2 | < 8.19.14-r0
elastic-agent-9.0All versions (No fix recorded)
elastic-agent-9.1All versions (No fix recorded)
elastic-agent-9.2< 9.2.8-r1 | < 9.2.8-r0
elastic-agent-9.3< 9.3.3-r1 | < 9.3.3-r0
elastic-agent-9.4< 9.4.3-r0 | < 9.4.1-r0 | < 9.4.2-r0
elastic-agent-fips-8.17All versions (No fix recorded)
elastic-agent-fips-8.18All versions (No fix recorded)
elastic-agent-fips-8.19< 8.19.14-r2 | < 8.19.14-r0
elastic-agent-fips-9.0All versions (No fix recorded)
elastic-agent-fips-9.1All versions (No fix recorded)
elastic-agent-fips-9.2< 9.2.8-r1 | < 9.2.8-r0
elastic-agent-fips-9.3< 9.3.3-r0 | < 9.3.3-r1
elastic-agent-fips-9.4< 9.4.2-r0 | < 9.4.3-r0 | < 9.4.1-r0
elastic-otel-collector-9.3< 9.3.3-r1
elastic-otel-collector-9.4< 9.4.3-r0

Show all 199

Alpine1 product

docker< 29.3.1-r0

2 vendors · 200 products · Showing 200 of 809

References

12 links

github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2X Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
github.com/moby/moby/releases/tag/docker-v29.3.1X Refsource MISCREPORTWEBRelease Notes
ubuntu.com/security/CVE-2026-34040REPORT
www.cve.org/CVERecord?id=CVE-2026-34040REPORT
security-tracker.debian.org/tracker/CVE-2026-34040Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34040.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-34040Advisory
github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fqWEB
github.com/moby/moby/commit/e89edb19ad7de0407a5d31e3111cb01aa10b5a38WEBFIX
docs.docker.com/engine/extend/plugins_authorizationWEB

Show all 12 references

github.com/moby/mobyPACKAGE
security.alpinelinux.org/vuln/CVE-2026-34040Advisory