CVE-2026-34040
CVSS 8.8 HIGH: moby is an open source container framework. EPSS 9% (95th percentile).
Vulnerabilities & Exploits
Docker Engine's CVE-2026-34040 is a high-severity authorization bypass that breaks the assumption that authorization plugins see the full API request body. This flaw allows attackers to send padded API requests that omit the request body from the plugin's view, enabling unauthorized actions that can lead to host compromise. The vulnerability is a regression and an incomplete fix for CVE-2024-41110, showing that prior patches did not fully address the underlying issue.
The risk extends beyond a single API call because authorization plugins relying on request-body inspection can be bypassed even if their logic is correct. This means the Docker host itself is at risk, not just the container or API endpoint. Docker Engine 29.3.1 includes a fix for this issue. Operators using authorization plugins that inspect request bodies must update immediately to prevent attackers from exploiting this bypass to gain root-level access to the host environment.
2 sources · Apr 10
CVSS 8.8 HIGH: moby is an open source container framework. EPSS 9% (95th percentile).
CSO Online
Old Docker authorization bypass pops up despite previous patch
A 10-year-old issue involving Docker Engine and the AuthZ authorization plug-in lives again to enable attackers to gain root-level access to host systems.
originalThe Hacker News
Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access
Docker CVE-2026-34040 enables AuthZ bypass via padded requests, risking host compromise; fixed in version 29.3.1.
originalPart of the PlainSec briefing for 2026-04-11
Every edition of this story: Docker AuthZ Bypass Reopens Host Compromise Risk