CVE-2026-41568: 
cAdvisor 脆弱性の分析と軽減

CVE-2026-41568 is a race condition vulnerability in Docker Engine and Moby that allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. It affects Docker Engine versions prior to 29.5.1, Docker Daemon (Moby) versions 28.5.2 and earlier, and Moby Daemon versions prior to 2.0.0-beta.14. The vulnerability was published on May 18, 2026, and assigned a CVSS v3.1 base score of 6.1 (Medium/Moderate) (GitHub Advisory, Moby Advisory).

The root cause is a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) combined with symlink following (CWE-61) in the docker cp mount setup process. When copying files into a container, the daemon resolves the mount destination path within the container root via GetResourcePath, then calls createIfNotExists to create the mountpoint using standard os.MkdirAll and os.OpenFile — both of which follow symlinks in intermediate path components. Between path resolution and mountpoint creation, a process inside the container can rapidly swap a path component for a symlink pointing to an arbitrary host location, causing the daemon to create files or directories outside the container root as root. Exploitation requires a container with volume mounts, a process inside the container capable of rapidly swapping symlinks, and an operator triggering docker cp or calling the PUT /containers/{id}/archive or HEAD /containers/{id}/archive API endpoints (Moby Advisory).

A malicious container can create empty files or directories at arbitrary absolute paths on the host filesystem, executing as root, enabling persistent denial of service scenarios. Concrete examples include converting /etc/docker/daemon.json into a directory to prevent the Docker daemon from restarting, creating /etc/nologin to block user logins, or overwriting critical system paths with empty files to break host services. Importantly, the container does not gain read or write access to existing host file contents — the impact is limited to creation of new empty files or directories, with no confidentiality breach but significant availability and limited integrity impact (Moby Advisory, GitHub Advisory).

1. Prepare malicious container: Deploy a container image that includes a process capable of rapidly creating and swapping symlinks at a volume mount destination path. The container must have at least one volume mount configured.
2. Start symlink race loop: Inside the running container, launch a background process that continuously alternates a path component at the volume mount destination between a legitimate directory and a symlink pointing to a sensitive host path (e.g., /etc/docker/ or /etc/).
3. Trigger docker cp: As an operator (or by compromising an operator account), initiate a docker cp operation into the target container, or call the PUT /containers/{id}/archive or HEAD /containers/{id}/archive Docker API endpoints targeting the container.
4. Win the race: If the symlink swap occurs between the daemon's GetResourcePath resolution and the createIfNotExists call, the daemon follows the symlink and creates an empty file or directory at the attacker-chosen host path as root.
5. Achieve denial of service: The created artifact (e.g., a directory at /etc/docker/daemon.json) persists on the host, disrupting critical services or preventing the Docker daemon from restarting (Moby Advisory).

• File System: Unexpected empty files or directories created at sensitive host paths such as /etc/docker/daemon.json (as a directory), /etc/nologin, or other critical system paths; new empty files or directories owned by root appearing outside container filesystems.
• Logs: Docker daemon logs showing docker cp or archive API calls (PUT /containers/{id}/archive, HEAD /containers/{id}/archive) to containers with volume mounts; errors related to daemon restart failures caused by corrupted configuration paths.
• Process: Rapid symlink creation/swap activity within a container's filesystem namespace, observable via inotifywait or auditd rules on volume mount paths; unusual child processes inside containers performing high-frequency filesystem operations.
• Network: Unexpected calls to the Docker API archive endpoints (PUT /containers/{id}/archive, HEAD /containers/{id}/archive) from unauthorized or unexpected clients (Moby Advisory).

Upgrade to Docker Engine 29.5.1 or Moby Daemon 2.0.0-beta.14, which fix the issue by scoping all mountpoint creation operations through os.Root (Go 1.24+), preventing symlink escape from the container root. For environments that cannot immediately upgrade, the following workarounds reduce risk: only run containers from trusted images; avoid using docker cp with untrusted running containers; and use Docker authorization plugins to restrict access to the PUT /containers/{id}/archive and HEAD /containers/{id}/archive API endpoints. Note that containers without volume mounts are not affected by this vulnerability (Moby Advisory, GitHub Advisory).

The vulnerability was reported by researcher manizada and remediated by vvoland from the Moby project team. The advisory notes a related race condition during the subsequent mount syscall tracked separately under GHSA-rg2x-37c3-w2rh, indicating the Moby security team conducted a broader audit of the docker cp code path. No significant public social media discussion or major media coverage has been identified beyond standard vulnerability database indexing (Moby Advisory).