CVE-2026-42306CWE-367CWE-61

Moby: Race condition in docker cp allows bind mount redirection to host path

High · published June 12, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
0.8
In the wild
Unconfirmed
What it is

Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00100 · 0.8th percentile
Weaknesses
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition; CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2026-06-12T18:09Z
EPSS history
Timeline
  • 12 JUN 18:09Z
    Moby: Race condition in docker cp allows bind mount redirection to host path
    cvelistv5