CVE-2026-42306

A flaw was found in the Moby container framework. A race condition occurs during the docker cp mount setup, which a malicious container can exploit. This vulnerability allows the container to redirect a bind mount target to an arbitrary path on the host system. Consequently, an attacker could overwrite host files, potentially leading to data corruption or a denial of service.

This vulnerability is rated as having an Important severity because successful exploitation allows a compromised container with volume mounts to manipulate host filesystem paths, leading to high integrity and availability impact across container boundaries despite the timing constraints of the race condition. Standard Red Hat platforms, including Red Hat Enterprise Linux and Red Hat OpenShift, utilize alternative container engines such as Podman and CRI-O by default that do not incorporate this daemon mount logic. Where Moby packages are pulled in as dependencies across Red Hat components, the affected daemon mount setup code path is typically not exposed or executed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.