Race Condition in Docker Engine Allows Host File Overwrite

Executive Summary

CVE-2026-42306 is a race condition vulnerability in Docker's `docker cp` command that affects Docker Engine versions prior to 29.5.1 and Moby Daemon versions prior to 2.0.0-beta.14.

During the setup of a temporary filesystem view when copying files into a container, there is a timing window between creating the mountpoint and the mount system call. A malicious container can exploit this window by replacing the destination or a parent path component with a symbolic link pointing to an arbitrary host path.

This causes the bind mount to be attached to an unintended host path, potentially allowing the container to overwrite host files or cause denial of service.

Exploitation requires a container with at least one volume mount, the ability to rapidly create and swap symlinks, and an operator initiating a `docker cp` or using the archive API endpoints.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts depending on the permissions of the volume mounts involved.

• If the volume is writable, a malicious container can overwrite arbitrary files on the host system, potentially leading to data loss or system compromise.
• If the volume is read-only, the attacker can mask host paths, causing denial of service by disrupting expected file access.

The effects of any writes persist even though the mount is temporary, meaning damage can be lasting.

Overall, this can lead to high integrity and availability impacts on the host system.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying if Docker Engine or Moby Daemon versions prior to the patched versions are in use, and monitoring for suspicious activity related to the `docker cp` command or archive API endpoints.

Specifically, you can check the installed Docker or Moby versions with commands like:

• `docker version` - to check Docker Engine version.
• `moby version` or checking the Moby daemon version if applicable.

Additionally, monitoring for rapid creation and swapping of symlinks inside containers with volume mounts, and unusual usage of `docker cp` or archive API endpoints, may help detect exploitation attempts.

However, no specific detection commands or tools are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Avoid using the `docker cp` command with untrusted containers.
• Run only trusted container images to reduce the risk of exploitation.
• Restrict access to the archive API endpoints to prevent unauthorized use.
• Upgrade Docker Engine to version 29.5.1 or later, or Moby Daemon to version 2.0.0-beta.14 or later, where the vulnerability is patched.

Useful 0 Not Useful 0