CVE-2026-42306: Docker Race Condition in docker cp Allows Bind Mount Redirection to Host Path
Summary
CVE-2026-42306: Docker: Race condition in docker cp allows bind mount redirection to host path. Affects github.com/docker/docker versions < 28.5.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker is an open-source platform that automates the deployment of applications inside software containers. It enables developers to package applications with all their dependencies into a standardized unit for software development. The vulnerability in question arises from a race condition during the docker cp operation, which can lead to unauthorized access and potential overwriting of host files.
Vulnerability Detail
A race condition during the setup of docker cp allows a malicious container to redirect a bind mount target to an arbitrary host path. This occurs because, between the creation of the mountpoint and the execution of the mount() syscall, a process inside the container can replace the destination with a symlink pointing to an arbitrary location on the host. Consequently, the mount() syscall follows the symlink, leading to unintended consequences such as overwriting host files or causing denial of service. The vulnerability affects containers with volume mounts and requires rapid symlink manipulation by a process within the container.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To mitigate the risk, consider the following workarounds:
- Only run containers from trusted images.
- Avoid using
docker cpwith untrusted running containers. - Use authorization plugins to restrict access to the archive API endpoints (
PUT /containers/{id}/archive,HEAD /containers/{id}/archive).
Conclusion
The CVE-2026-42306 vulnerability in Docker presents a significant risk due to a race condition that allows bind mount redirection to arbitrary host paths. Users are advised to update their packages to the latest versions and implement recommended workarounds to mitigate potential risks.
See every vulnerability recorded for github.com/docker/docker →
FAQ
The CVSS score of this vulnerability is 7.2, indicating a high severity level.
A container must have at least one volume mount, and a process inside the container must be able to rapidly create and swap symlinks at the volume mount destination path.
No, containers that do not have volume mounts are not affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The impacts include the possibility of overwriting arbitrary host files if the volume is writable or causing denial of service if the volume is read-only.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
