CVE-2026-34040highCWE-288

CVE-2026-34040: high-severity vulnerability in moby

Moby: AuthZ plugin bypass with oversized request body

Published · Updated

Follow this CVE+ Monitor moby+ Monitor docker.io

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.8epss 9.3%
from disclosure to weapon68 days
Published on NVDMar 31
1st PoC+68d
In short

Moby container framework had a flaw that let attackers bypass security authorization checks by sending specially crafted requests with oversized bodies. This could allow unauthorized access to container operations that should have been blocked.

Technical detail

A vulnerability in Moby prior to v29.3.1 permits AuthZ plugin bypass via oversized request body manipulation (CWE-288: Improper Authentication). The attack requires no privileges and directly circumvents authorization controls, enabling unauthorized container operations with high integrity and confidentiality impact.

Summary generated and translated by AI from the official description.
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
moby · moby
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — moby

In the same product, most dangerous first.

CVE-2024-41110CRITICALMoby authz zero length regressionEPSS 16.5%CVE-2021-21285MEDIUMDocker daemon crash during image pull of malicious imageEPSS 3.3%CVE-2021-41091MEDIUMInsufficiently restricted permissions on data directory in Docker EngineEPSS 2.8%CVE-2023-28840HIGHmoby/moby's dockerd daemon encrypted overlay network may be unauthenticatedEPSS 2.6%CVE-2023-28842MEDIUMmoby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticatedEPSS 1.4%CVE-2021-21284MEDIUMprivilege escalation in MobyEPSS 1.1%