Docker Engine's CVE-2026-34040 is a high-severity authorization bypass that breaks the assumption that authorization plugins see the full API request body. This flaw allows attackers to send padded API requests that omit the request body from the plugin's view, enabling unauthorized actions that can lead to host compromise. The vulnerability is a regression and an incomplete fix for CVE-2024-41110, showing that prior patches did not fully address the underlying issue.
The risk extends beyond a single API call because authorization plugins relying on request-body inspection can be bypassed even if their logic is correct. This means the Docker host itself is at risk, not just the container or API endpoint. Docker Engine 29.3.1 includes a fix for this issue. Operators using authorization plugins that inspect request bodies must update immediately to prevent attackers from exploiting this bypass to gain root-level access to the host environment.