Docker Engine AuthZ Plugin Bypass via Oversized Request Body
Intelligence Database
High SeverityScore: 8.8

CVE-2026-34040
Docker Engine AuthZ Plugin Bypass via Oversized Request Body

June 25, 2026
CVSS: 8.8
Complexity
Low
User Inter.
None
Privileges
Root
Scope
Changed

Vulnerability Overview

Disclosed in late June 2026, CVE-2026-34040 is a high-severity vulnerability in the Moby (Docker Engine) container framework. It represents an incomplete fix for the well-known CVE-2024-41110 security bypass.

Under certain configurations, an attacker with access to the Docker API socket (or TCP port) can bypass configured authorization (AuthZ) plugins (such as Open Policy Agent, Prisma Cloud, or custom policy engines) by crafting oversized API requests (exceeding 1MB). This allows unauthorized requests to be executed directly by the Docker daemon, potentially leading to unauthorized container creation, privilege escalation, and full host takeover.

Exploitation Potential: If your Docker daemon relies on AuthZ plugins to enforce RBAC or restrict privileges (such as forbidding --privileged container creation), this vulnerability completely bypasses that defense-in-depth layer.

Technical Details

Docker Engine uses plugins to authorize API requests. When a client makes a request, the Docker daemon forwards the request metadata and body to the plugin for policy decisions.

To prevent excessive memory consumption and performance bottlenecks, Docker limits the size of the request body forwarded to plugins. However, the initial mitigation for CVE-2024-41110 did not correctly handle request bodies that exceeded this threshold.

In CVE-2026-34040, sending a request with a payload larger than 1MB causes the Docker daemon to forward the request metadata to the AuthZ plugin without sending the request body itself. Because the plugin does not receive the body (e.g., the JSON payload containing parameters like HostConfig.Privileged: true), it may evaluate the request based purely on the metadata (such as the URI /containers/create) and approve it. The Docker daemon then proceeds to execute the original, oversized request with the full body, enabling the unauthorized action.

Attack Vector Flow

Loading diagram...

Mitigation & Remediation

Organizations that enforce access control policies on the Docker API using AuthZ plugins must take immediate action.

1. Upgrade Docker Engine

The primary fix is to update Docker Engine or Docker Desktop to the latest patched releases. The fix enforces correct boundary checks and ensures that oversized request bodies are handled securely by rejecting them or ensuring the AuthZ plugin is aware of the payload context.

  • Patched Versions: Moby (Docker Engine) 29.3.1, Docker Desktop 4.66.1 or newer.

Ubuntu / Debian Upgrade:

sudo apt-get update
sudo apt-get install --only-upgrade docker-ce docker-ce-cli containerd.io

RHEL / Rocky Linux Upgrade:

sudo dnf upgrade docker-ce docker-ce-cli containerd.io -y

2. Restrict Docker API Access (Mitigation)

If immediate upgrading is not feasible, restrict access to the Docker socket (/var/run/docker.sock) or port:

  • Ensure that the Docker socket is not exposed to untrusted containers or unprivileged host users.
  • If Docker is exposed over TCP, enforce mutual TLS (mTLS) with strong certificates and restrict access to trusted source IPs.

3. Verify Plugin Policies

Audit your AuthZ plugins to ensure they default to Deny if the request body is missing or if the payload size exceeds a specific safe threshold.

Threat Response Advisory

Our intelligence team monitors these vulnerabilities 24/7. For real-time threat detection and custom mitigation playbooks, contact our SOC response unit.