CVE-2024-41110

Published Jul 24, 2024

Last updated 9 days ago

CVSS critical 9.9
Docker
Container Security

Overview

Description
Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low. Using a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it. A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted. Docker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable. docker-ce v27.1.1 containes patches to fix the vulnerability. Patches have also been merged into the master, 19.03, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches. If one is unable to upgrade immediately, avoid using AuthZ plugins and/or restrict access to the Docker API to trusted parties, following the principle of least privilege.
Source
security-advisories@github.com
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.9
Impact score
6
Exploitability score
3.1
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

security-advisories@github.com
CWE-187

Social media

Hype score
Not currently trending

  1. Docker Engine の脆弱性 CVE-2026-34040 が FIX：AuthZ バイパスによる権限昇格の恐れ https://t.co/LBCQAOrcuI Docker Engine の脆弱性 CVE-2026-34040 は、以前に報告された CVE-2024-41110 に対する修正が不十分だったことに起因します。

    @iototsecnews

    16 Apr 2026

    59 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 🚨 Security Alert: CVE-2026-34040 (CVSS 8.8) is critical due to an incomplete fix for CVE-2024-41110. Discovered by Asim Viladi Oglu Manizada & team. Update Docker Engine v29.3.1 ASAP! 🚀 Beware AI agents exploiting padded HTTP requests! #CyberSecurity #Docker #Vulnerabil

    @ReliableEmbSys

    10 Apr 2026

    62 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. 🚨Dockerに新たな脆弱性CVE-2026-34040が発覚！ 認証プラグインをバイパスされ、ホストへのアクセスを許してしまう可能性が😱 CVE-2024-41110の不完全な修正が原因です。認証プラグイン利用者は要注意！早急な対

    @motch_dev

    8 Apr 2026

    78 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  4. Apr 07, 2026 🚨 A critical vulnerability (CVE-2026-34040) in Docker Engine allows attackers to bypass authorization plugins, risking host access. This stems from an incomplete fix for CVE-2024-41110. https://t.co/U9Ys7FqKRk

    @kernyx64

    7 Apr 2026

    35 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. CVE-2024-41110 Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine ... https://t.co/uuXQHHefg3 https://t.co/90m9lgMcXc

    @CVEradars

    2 Apr 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. Actively exploited CVE : CVE-2024-41110

    @transilienceai

    17 Nov 2024

    16 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

Related CVEs

  1. CVE-2025-14269
  2. Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Prior to version 1.1.25, Docker Model Runner contains an SSRF vulnerability in its OCI registry token exchange flow. When pulling a model, Model Runner follows the realm URL from the registry's WWW-Authenticate header without validating the scheme, hostname, or IP range. A malicious OCI registry can set the realm to an internal URL (e.g., http://127.0.0.1:3000/), causing Model Runner running on the host to make arbitrary GET requests to internal services and reflect the full response body back to the caller. Additionally, the token exchange mechanism can relay data from internal services back to the attacker-controlled registry via the Authorization: Bearer header. This issue has been patched in version 1.1.25. For Docker Desktop users, enabling Enhanced Container Isolation (ECI) blocks container access to Model Runner, preventing exploitation. However, if the Docker Model Runner is exposed to localhost over TCP in specific configurations, the vulnerability is still exploitable.•CVE-2026-33990
  3. Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.•CVE-2026-33997
  4. Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.•CVE-2026-34040
  5. Aquasecurity Trivy Embedded Malicious Code Vulnerability•CVE-2026-33634

References

Sources include official advisories and independent security research.