Docker: `PUT /containers/{id}/archive` executes container binary on the host
Summary
| CVE | CVE-2026-41567 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-06-05 02:17:13 UTC |
| Updated | 2026-07-24 13:18:18 UTC |
| Description | Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from ADP
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
EPSS: 0.001540000 probability, percentile 0.050210000 (date 2026-07-24)
Problem Types: CWE-427 | CWE-427 CWE-427: Uncontrolled Search Path Element | CWE-427 Uncontrolled Search Path Element
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | CVSS | 7.5 | HIGH | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
| 3.1 | [email protected] | Secondary | 7.2 | HIGH | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 7.5 | HIGH | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
| 3.1 | CNA | DECLARED | 7.2 | HIGH | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
HighPrivileges Required
LowUser Interaction
RequiredScope
ChangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Moby | Moby/v2/daemon | affected < 2.0.0-beta.14 | Not specified |
| CNA | Moby | Docker Engine | affected < 29.5.1 | Not specified |
| CNA | Docker | Docker/daemon | affected <= 28.5.2 | Not specified |
| ADP | Red Hat | Multicluster Global Hub 1.4.5 | unaffected 1784060681 * rpm | Not specified |
| ADP | Red Hat | Multicluster Global Hub 1.5.6 | unaffected 1784562060 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1782932114 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1782931768 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1782932104 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1783536000 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1783535989 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1783536515 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1782932521 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1783018461 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1783018421 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1782932812 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1783537001 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1782932919 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1783537586 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1782932969 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1782933015 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1782933042 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1783537392 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1782933235 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1782933251 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1783537955 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1782933417 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1783537742 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1782933602 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1783019377 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1782934054 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1782934036 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.22 | unaffected 1782934284 * rpm | Not specified |
| ADP | Red Hat | Exploit Intelligence | Not specified | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes | Not specified | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes | Not specified | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes | Not specified | Not specified |
| ADP | Red Hat | OpenShift Lightspeed | Not specified | Not specified |
| ADP | Red Hat | OpenShift Source-to-Image S2I | Not specified | Not specified |
| ADP | Red Hat | OpenShift Source-to-Image S2I | Not specified | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ceph Storage 5 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ceph Storage 7 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ceph Storage 8 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ceph Storage 9 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 10 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | Not specified | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | Not specified | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | Not specified | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | Not specified | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | Not specified | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | Not specified | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | Not specified | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | Not specified | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Distributed Tracing 3 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41567.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r | [email protected] | github.com | |
| access.redhat.com/errata/RHSA-2026:37387 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-41567 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:42852 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:41030 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2026-06-05T02:00:54.488Z | Reported to Red Hat. |
| ADP | 2026-06-05T00:35:50.563Z | Made public. |
Solutions
ADP: RHSA-2026:41030: Multicluster Global Hub 1.4.5
ADP: RHSA-2026:42852: Multicluster Global Hub 1.5.6
ADP: RHSA-2026:37387: Red Hat Openshift Data Foundation 4.22
Workarounds
ADP: To mitigate this issue, Red Hat recommends only running containers from trusted images. Additionally, users should avoid piping compressed archives into containers created from untrusted images. For environments utilizing authorization plugins, restricting access to the `PUT /containers/{id}/archive` endpoint can further reduce exposure.
There are currently no legacy QID mappings associated with this CVE.