CVE-2026-41567

A flaw was found in Moby, the open-source container framework, and Docker Engine. A malicious container image can exploit this vulnerability to achieve arbitrary code execution with full daemon privileges, including host root access. This occurs when a user uploads a compressed archive to the container, as the daemon incorrectly uses decompression binaries from the container's filesystem. This allows an attacker to gain complete control over the affected system.

This is an Important vulnerability. A flaw in Moby and Docker Engine allows for arbitrary code execution with host root privileges. This occurs when a user uploads a compressed archive to a container, as the daemon incorrectly uses decompression binaries from the container's filesystem. This could lead to a complete compromise of the host system if a malicious container image is utilized.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, Red Hat recommends only running containers from trusted images. Additionally, users should avoid piping compressed archives into containers created from untrusted images. For environments utilizing authorization plugins, restricting access to the PUT /containers/{id}/archive endpoint can further reduce exposure.