CVE-2026-41567

Description

Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images

How to fix CVE-2026-41567

To remediate CVE-2026-41567, upgrade the affected package to a fixed version below.

• —no fix listed
• —no fix listed
• —no fix listed
• —upgrade to 2.0.0-beta.14 or later

Is CVE-2026-41567 being exploited?

No exploitation signal available. Neither CISA KEV nor a current EPSS score has been published for CVE-2026-41567.

Affected packages (4)

• from 0
• from 0, <= 28.5.2
• from 0, <= 28.5.2
• from 0, < 2.0.0-beta.14

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-41567
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-41567
• PATCHgithub.com/moby/moby
• WEBgithub.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r