CVE-2017-20198CWE-732

DC/OS Marathon UI < 1.9.0 Unauthenticated RCE via Docker Mount Abuse

Critical · published July 23, 2025

CVSS v4.0
9.3
EPSS
1%
Percentile
68.4
In the wild
Unconfirmed
What it is

The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations, attackers can deploy a container that mounts the host's root filesystem (/) with read/write privileges. When using a malicious Docker image, the attacker can write to /etc/cron.d/ on the host, achieving arbitrary code execution with root privileges. This impacts any system where the Docker daemon honors Marathon container configurations without policy enforcement.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01223 · 68.4th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2025-07-23T13:50Z
EPSS history
Timeline
  • 23 JUL 13:50Z
    DC/OS Marathon UI < 1.9.0 Unauthenticated RCE via Docker Mount Abuse
    cvelistv5