CVE-2025-54388: Moby Docker Engine Vulnerability Allows Remote Access to Container Ports
Summary
CVE-2025-54388: Moby firewalld reload makes published container ports accessible from remote hosts. Affects github.com/docker/docker versions >= 28.2.0, < 28.3.3. Fixed in 28.3.3. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2025-54388 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moby is an open-source container framework developed by Docker Inc., commonly referred to as Docker or Docker Engine. It serves as the foundation for containerization, enabling developers to create, deploy, and manage applications in isolated environments. The Moby daemon component, dockerd, manages container lifecycle and networking, while Firewalld is a daemon used by some Linux distributions to manage firewall rules dynamically. This vulnerability arises from the interaction between Docker and Firewalld, leading to potential security risks.
Vulnerability Detail
The vulnerability occurs when Firewalld is reloaded, causing Docker's iptables rules to be removed. These rules are essential for isolating container networks and preventing unauthorized access. When the rules are not re-created, remote hosts can access published container ports, even if they were initially restricted to a loopback address. This issue primarily affects Docker versions prior to 28.3.3 and can expose sensitive services running within containers to external networks.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
28.3.3
This is the first release that contains the fix.
go get github.com/docker/docker@v28.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
After reloading Firewalld, you can implement one of the following workarounds: 1. Restart the Docker daemon using
sudo systemctl restart docker'. 2
Re-create the bridge networks using Docker commands. 3. Use Docker in rootless mode to avoid this issue altogether.
Conclusion
CVE-2025-54388 presents a significant security risk for users of the Moby Docker Engine, particularly when Firewalld is reloaded. It is crucial to update to the patched version 28.3.3 or implement the recommended workarounds to mitigate potential exposure of container services.
See every vulnerability recorded for github.com/docker/docker →
FAQ
The impact is that remote hosts can access published container ports that were intended to be isolated, potentially exposing sensitive services.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Docker versions prior to 28.3.3 are affected by this vulnerability.
If an immediate update is not possible, consider using the workarounds provided, such as restarting the Docker daemon or using rootless mode.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Gopkg.lock file.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
