CVE-2026-33997

MEDIUM

6.8

Descripcion

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.

Detalles CVE

Puntuacion CVSS v3.16.8

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Vector de ataqueNETWORK

ComplejidadHIGH

Privilegios requeridosNONE

Interaccion usuarioREQUIRED

Publicado3/31/2026

Ultima modificacion4/3/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

mobyproject:moby

Debilidades (CWE)

CWE-193

Referencias

https://github.com/moby/moby/releases/tag/docker-v29.3.1(security-advisories@github.com)

https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9(security-advisories@github.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.