CVE-2026-92543

A flaw was found in Docker Engine. This vulnerability can lead to information disclosure or container image tampering by allowing an attacker to intercept unencrypted registry traffic. The flaw exists because the engine disables Transport Layer Security (TLS) certificate verification if any resolved address of a registry hostname matches a trusted local loopback network. A remote attacker capable of manipulating Domain Name System (DNS) responses can inject a loopback address alongside an external server address, tricking the client into connecting to an attacker-controlled registry over insecure HTTP.

This vulnerability is rated as an Important severity flaw because successful exploitation allows an attacker to intercept registry communications and inject untrusted container images or capture sensitive credentials. Exploitation requires high attack complexity, as the adversary must actively manipulate DNS responses to return a loopback IP alongside a target remote IP. While Red Hat core container runtimes primarily rely on Podman and CRI-O rather than the Docker Engine daemon, certain platform utilities and embedded management tools that integrate Moby container client logic remain exposed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.