← Vulnerability feed

Vulnerability record · CVE-2026-33997 · published 31 March 2026

CVE-2026-33997: Docker engine vulnerability

Docker · Engine

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.

8.1 CVSS 3.1 High EPSS 0.51% · top 58.7% CWE-193 · CWE-193CWE-266 · CWE-266
8.1CVSS 3.1 base score
0.51%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
9 Sep 2026Last modified by NVD

Description

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/moby/moby/releases/tag/docker-v29.3.1 Release Notes
https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:21769
https://access.redhat.com/errata/RHSA-2026:22347
https://access.redhat.com/errata/RHSA-2026:23345
https://access.redhat.com/security/cve/CVE-2026-33997
https://bugzilla.redhat.com/show_bug.cgi?id=2453277
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33997.json

Track CVE-2026-33997 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2026-34040Docker engine authentication bypass via alternate path vulnerabilityMoby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass autho…EPSS 0.16%7.2CVE-2026-42306Docker engine toctou race condition vulnerabilityMoby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior …EPSS 0.10%6.1CVE-2026-41568Docker engine toctou race condition vulnerabilityMoby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior …EPSS 0.10%6.0CVE-2020-13401Docker engine improper input validation vulnerabilityAn issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertis…EPSS 2.8%4.9CVE-2018-20699Docker engine uncontrolled resource consumption vulnerabilityDocker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpu…EPSS 2.2%7.8CVE-2021-3156Sudo off-by-one heap overflow allows root privilege escalationSudo before 1.9.5p2 contains an off-by-one error leading to a heap-based buffer overflow. Triggering it via 'sudoedit -s' with a command-line argumen…KEVEPSS 100%analysed

Source: NIST National Vulnerability Database (record CVE-2026-33997), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.