CVE-2026-41567: Docker Container Binary Execution Vulnerability in github.com/docker/docker
Summary
CVE-2026-41567: Docker: PUT /containers/{id}/archive executes container binary on the host in github.com/docker/docker. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
The same CVE-2026-41567 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker is a widely used platform that enables developers to automate the deployment of applications inside lightweight, portable containers. The package 'github.com/docker/docker' provides the core functionalities for managing Docker containers. This package is essential for container orchestration and deployment, making it a critical component in modern software development. However, it is susceptible to vulnerabilities that can lead to severe security risks if not addressed promptly.
Vulnerability Detail
The vulnerability identified as CVE-2026-41567 arises from the Docker API endpoint PUT /containers/{id}/archive, which allows the execution of container binaries on the host system. This flaw can be exploited by an attacker to execute arbitrary code on the host, potentially leading to unauthorized access, data breaches, or system compromise. The vulnerability affects multiple versions of the Docker package, making it crucial for users to be aware of the risks and take necessary actions to mitigate them.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Docker API to trusted networks only, thereby minimizing the risk of exploitation. Additionally, consider using container security best practices, such as running containers with the least privilege and employing security tools to monitor container activity.
Conclusion
The vulnerability CVE-2026-41567 poses a significant risk to Docker users, allowing unauthorized execution of binaries on the host system. It is essential to update affected packages to the patched versions to safeguard your applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for github.com/docker/docker →
FAQ
CVE-2026-41567 is a vulnerability in Docker that allows the execution of container binaries on the host system through a specific API endpoint.
Exploitation of this vulnerability can lead to unauthorized code execution on the host, potentially resulting in data breaches or system compromise.
The vulnerability affects all versions of 'github.com/docker/docker' and 'github.com/moby/moby' prior to the patched versions.
You can use Vulert, a tool that monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
If immediate updates are not possible, restrict access to the Docker API and implement security best practices to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
