CVE-2026-34040: 
cAdvisor vulnerability analysis and mitigation

CVE-2026-34040 is a high-severity authorization plugin bypass vulnerability in Moby (Docker Engine) that allows attackers to circumvent AuthZ plugins by sending specially crafted API requests with oversized request bodies. It is classified as an incomplete fix for the earlier CVE-2024-41110 (GHSA-v23v-6jw2-98fq). Affected versions include github.com/docker/docker and github.com/moby/moby prior to 29.3.1, and github.com/moby/moby/v2 prior to 2.0.0-beta.8. The vulnerability was published on March 25, 2026, and carries a CVSS v3.1 score of 8.8 (High) with a changed scope (GitHub Advisory, Moby Advisory).

The root cause is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and CWE-863 (Incorrect Authorization). When the Docker daemon receives an API request with an oversized body, it forwards the request to the configured AuthZ plugin without including the request body. Authorization plugins that rely on inspecting the request body to make access control decisions will then evaluate an incomplete request and may incorrectly permit operations they would otherwise deny. The attack requires local access with low privileges and no user interaction, but the scope change (S:C) reflects that a successful bypass can affect resources outside the Docker daemon's security boundary (GitHub Advisory). Cyera Research published a detailed technical write-up titled "One Megabyte to Root: How a Size Check Broke Docker's Last Line of Defense" describing the mechanics of the body-stripping behavior (Cyera Research).

A locally authenticated attacker with low privileges can bypass Docker's authorization plugin layer, enabling unauthorized container operations such as creating privileged containers, mounting host filesystems, or executing arbitrary commands on the host. This can lead to full host compromise, credential theft from the host filesystem, and lateral movement within the environment. Organizations relying on AuthZ plugins (e.g., Open Policy Agent-based plugins) for multi-tenant Docker access control are most severely impacted, as the security boundary they depend on can be silently bypassed (GitHub Advisory, Cyera Research).

As of the time of reporting, no public proof-of-concept exploit code has been confirmed, and there is no verified evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.009% (1st percentile), indicating a currently low probability of exploitation within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Feedly threat intelligence notes the vulnerability is actively discussed in the context of malware campaigns targeting exposed Docker APIs, and the Sploitus exploit aggregator has indexed a related entry (Feedly). No specific threat actor attribution has been made.

1. Reconnaissance: Identify Docker hosts with AuthZ plugins enabled and accessible Docker API sockets (local or via TCP). Confirm the target is running Moby/Docker Engine < 29.3.1.
2. Craft oversized request: Prepare an HTTP POST API request targeting a sensitive Docker API endpoint (e.g., /containers/create to create a privileged container) with a request body padded to exceed the size threshold that triggers body stripping in the daemon.
3. Send the crafted request: Submit the oversized request to the Docker daemon's API socket. The daemon, upon receiving the oversized body, forwards the request to the AuthZ plugin without the body.
4. AuthZ plugin bypass: The authorization plugin evaluates the bodyless request and, lacking the context needed to deny it, permits the operation.
5. Execute unauthorized operation: The Docker daemon processes the now-approved request, allowing the attacker to create privileged containers, mount host directories, or perform other restricted operations.
6. Achieve host access: Use the privileged container to escape to the host filesystem, read sensitive credentials, or establish persistence (GitHub Advisory, Cyera Research).

• Network: Unusually large HTTP POST requests to Docker API endpoints (e.g., /containers/create, /images/create) via the Docker socket or TCP API port (default 2375/2376); outbound connections from the Docker host to unexpected external IPs following API calls.
• Logs: Docker daemon logs (/var/log/docker.log or journalctl -u docker) showing API requests approved by AuthZ plugins for operations that should have been denied; requests with Content-Length values significantly larger than typical for the endpoint.
• File System: Unexpected new containers with --privileged flags or host volume mounts (/ or /etc mounted into containers); new files or scripts written to host paths from within containers; unauthorized SSH keys or cron jobs added to host system accounts.
• Process: Unusual child processes spawned from container runtimes (e.g., runc, containerd-shim) that access host-level resources; processes running as root outside expected container namespaces (GitHub Advisory, Cyera Research).

The primary fix is to upgrade Docker Engine (Moby) to version 29.3.1 or later (for v2 users: 2.0.0-beta.8 or later), which was released on March 25, 2026 (Moby Release). If immediate patching is not possible, the following workarounds are recommended: (1) Avoid using AuthZ plugins that rely solely on request body inspection for access control decisions; (2) Restrict access to the Docker API socket to trusted, least-privileged users only; (3) Implement network-level controls to prevent unauthorized access to the Docker API. Mirantis Container Runtime users should verify their specific version includes the patch, as the latest release may not have incorporated it (GitHub Advisory).

Cyera Research, which discovered the vulnerability, published a detailed technical blog post titled "One Megabyte to Root: How a Size Check Broke Docker's Last Line of Defense," drawing significant attention from the security community (Cyera Research). The Hacker News covered the story with the headline "Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access," amplifying community awareness (The Hacker News). Security researchers on Mastodon, Bluesky, and Reddit discussed the vulnerability's significance as a recurring pattern — noting it is an incomplete fix for CVE-2024-41110, which had been patched previously. CSO Online highlighted the irony of the "old Docker authorization bypass" resurfacing despite a prior patch (CSO Online). Docker's official security dispatch acknowledged the issue and referenced the patch in their security communications.