{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34040", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-25T15:29:04.744Z", "datePublished": "2026-03-31T01:36:48.205Z", "dateUpdated": "2026-04-02T03:55:56.676Z"}, "containers": {"cna": {"title": "Moby: AuthZ plugin bypass with oversized request body", "problemTypes": [{"descriptions": [{"cweId": "CWE-288", "lang": "en", "description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2"}, {"name": "https://github.com/moby/moby/releases/tag/docker-v29.3.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/moby/moby/releases/tag/docker-v29.3.1"}], "affected": [{"vendor": "moby", "product": "moby", "versions": [{"version": "< 29.3.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T01:36:48.205Z"}, "descriptions": [{"lang": "en", "value": "Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1."}], "source": {"advisory": "GHSA-x744-4wpc-v9h2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-34040"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T03:55:56.676Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34040", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-31T15:34:44.687422Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T15:34:59.017Z"}}], "cna": {"title": "Moby: AuthZ plugin bypass with oversized request body", "source": {"advisory": "GHSA-x744-4wpc-v9h2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "moby", "product": "moby", "versions": [{"status": "affected", "version": "< 29.3.1"}]}], "references": [{"url": "https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2", "name": "https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/moby/moby/releases/tag/docker-v29.3.1", "name": "https://github.com/moby/moby/releases/tag/docker-v29.3.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-288", "description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T01:36:48.205Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34040", "state": "PUBLISHED", "dateUpdated": "2026-04-02T03:55:56.676Z", "dateReserved": "2026-03-25T15:29:04.744Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-31T01:36:48.205Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:*", "matchCriteriaId": "B2D4D20A-9812-42C7-AB9B-2B63DA90EB21", "versionEndExcluding": "29.3.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1."}, {"lang": "es", "value": "Moby es un framework de contenedores de c\u00f3digo abierto. Antes de la versi\u00f3n 29.3.1, se ha detectado una vulnerabilidad de seguridad que permite a los atacantes eludir los plugins de autorizaci\u00f3n (AuthZ). Este problema ha sido parcheado en la versi\u00f3n 29.3.1."}], "id": "CVE-2026-34040", "lastModified": "2026-04-03T16:51:28.670", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-03-31T03:15:57.883", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/moby/moby/releases/tag/docker-v29.3.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-288"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "Moby: Moby: Authorization bypass vulnerability", "id": "2453278", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453278"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-807", "details": ["Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.", "A flaw was found in Moby, an open-source container framework. This security vulnerability allows attackers to bypass authorization plugins (AuthZ), which are mechanisms designed to control access and permissions within the container environment. The bypass of these plugins can lead to unauthorized operations and potential compromise of the system's integrity and confidentiality."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-34040", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "redhat-user-workloads/assisted-service-rhel8-acm-ds-2-11", "product_name": "Multicluster Engine for Kubernetes"}, {"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "redhat-user-workloads/assisted-service-rhel8-acm-ds-2-12", "product_name": "Multicluster Engine for Kubernetes"}, {"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "redhat-user-workloads/assisted-service-rhel8-acm-ds-2-13", "product_name": "Multicluster Engine for Kubernetes"}, {"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "redhat-user-workloads/assisted-service-rhel8-acm-ds-2-14", "product_name": "Multicluster Engine for Kubernetes"}, {"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "redhat-user-workloads/assisted-service-rhel9-acm-ds-2-11", "product_name": "Multicluster Engine for Kubernetes"}, {"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "redhat-user-workloads/assisted-service-rhel9-acm-ds-2-12", "product_name": "Multicluster Engine for Kubernetes"}, {"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "redhat-user-workloads/assisted-service-rhel9-acm-ds-2-13", "product_name": "Multicluster Engine for Kubernetes"}, {"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "redhat-user-workloads/assisted-service-rhel9-acm-ds-2-14", "product_name": "Multicluster Engine for Kubernetes"}, {"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "redhat-user-workloads/assisted-service-rhel9-acm-ds-2-15", "product_name": "Multicluster Engine for Kubernetes"}, {"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "redhat-user-workloads/assisted-service-rhel9-acm-ds-2-16", "product_name": "Multicluster Engine for Kubernetes"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "redhat-user-workloads/glo-grafana-globalhub-1-4", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "redhat-user-workloads/glo-grafana-globalhub-1-5", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "redhat-user-workloads/glo-grafana-globalhub-1-6", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "redhat-user-workloads/glo-grafana-globalhub-1-7", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:service_mesh:2", "fix_state": "Affected", "package_name": "redhat-user-workloads/ossm-2-6-operator", "product_name": "OpenShift Service Mesh 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "redhat-user-workloads/grafana-acm-214", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "redhat-user-workloads/grafana-acm-215", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "redhat-user-workloads/grafana-acm-216", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:5", "fix_state": "Affected", "package_name": "rhceph-ci/grafana", "product_name": "Red Hat Ceph Storage 5"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift3/ose-console", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-agent-installer-api-server-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-agent-installer-api-server-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-console", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "redhat-user-workloads/art-images", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:container_native_virtualization:4", "fix_state": "Affected", "package_name": "openshift-virtualization/hostpath-csi-driver-rhel9", "product_name": "Red Hat OpenShift Virtualization 4"}, {"cpe": "cpe:/a:redhat:container_native_virtualization:4", "fix_state": "Affected", "package_name": "openshift-virtualization/hostpath-provisioner-operator-rhel9", "product_name": "Red Hat OpenShift Virtualization 4"}, {"cpe": "cpe:/a:redhat:container_native_virtualization:4", "fix_state": "Affected", "package_name": "openshift-virtualization/hostpath-provisioner-rhel9", "product_name": "Red Hat OpenShift Virtualization 4"}, {"cpe": "cpe:/a:redhat:container_native_virtualization:4", "fix_state": "Affected", "package_name": "openshift-virtualization/hyperconverged-cluster-operator-rhel9", "product_name": "Red Hat OpenShift Virtualization 4"}, {"cpe": "cpe:/a:redhat:container_native_virtualization:4", "fix_state": "Affected", "package_name": "openshift-virtualization/hyperconverged-cluster-webhook-rhel9", "product_name": "Red Hat OpenShift Virtualization 4"}], "public_date": "2026-03-31T01:36:48Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-34040\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34040\nhttps://github.com/moby/moby/releases/tag/docker-v29.3.1\nhttps://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,29.3.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "moby", "source": "cna", "vendor": "moby"}, "product": "moby", "vendor": "moby"}], "analysis": {"en": {"generated_at": "2026-04-06T15:50:32.982862+00:00", "value": {"mitigation_remediation": ["Upgrade Moby to version 29.3.1 or newer.", "Verify that the upgrade has been applied correctly by checking the Moby version and conducting a basic authorization test.", "If an immediate upgrade is not possible, restrict inbound traffic to the Moby service to trusted IP addresses using a firewall or proxy to reduce exposure to the exploit."], "summary": {"action": "Patch Immediately", "impact": "Authorization Bypass"}, "threat_synthesis": {"affected_systems": "All versions of Moby released before 29.3.1 are affected. The vulnerability was fixed in release 29.3.1 and later versions are not vulnerable.", "description_and_impact": "A flaw in the Moby container framework allows an attacker to bypass authorization plugins by submitting an oversized request body. This privilege escalation can grant the attacker the ability to perform actions that normally require explicit authorization, potentially compromising the confidentiality, integrity and availability of the container environment. The weakness is classified under CWE\u2011288 and CWE\u2011807 and carries a CVSS score of 8.8.", "risk_and_exploitability": "The CVSS base score indicates significant risk, while the EPSS value of less than 1% suggests that public exploitation is currently uncommon. The vulnerability is not listed in CISA\u2019s KEV catalog. The likely attack path requires direct network access to the Moby service and involves crafting a request that exceeds the expected body size to trigger the authorization bypass."}}}}, "created": "2026-03-31T19:56:30.468457+00:00", "updated": "2026-04-07T08:08:14.680767+00:00", "vendors": ["moby", "moby$PRODUCT$moby"]}