CVE-2021-41089: Docker Engine - Unexpected chmod of host files in Moby Docker Engine
Summary
CVE-2021-41089: docker cp allows unexpected chmod of host files in Moby Docker Engine. Affects github.com/docker/docker versions < 20.10.9. Fixed in 20.10.9. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2021-41089 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker Engine, also known as Moby, is an open-source containerization platform that allows users to automate the deployment and management of applications within containers. It provides an efficient and scalable solution for isolating applications and their dependencies. However, a vulnerability has been discovered in Docker Engine that can lead to unexpected changes in file permissions on the host's filesystem when using the 'docker cp' command to copy files into a container.
Vulnerability Detail
The vulnerability in Docker Engine arises when attempting to copy files into a specially-crafted container using the 'docker cp' command. This can result in unintended changes to the Unix file permissions of existing files on the host's filesystem, potentially widening access to unauthorized users. It's important to note that this vulnerability does not directly allow unauthorized access to read, modify, or execute files without additional cooperation from another process.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
20.10.9
This is the first release that contains the fix.
go get github.com/docker/docker@v20.10.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can mitigate the risk by ensuring they only run trusted containers. By carefully vetting and validating the containers used, the likelihood of exploitation can be reduced. However, this workaround is not a permanent solution and should be seen as a temporary measure until the Docker Engine update can be applied.
Conclusion
The vulnerability in Docker Engine that allows unexpected changes in file permissions on the host's filesystem has been addressed in version 20.10.9. Users should promptly update their Docker Engine installation to mitigate the risk of unauthorized access to host files. It is recommended to only run trusted containers and apply the Docker Engine update as soon as possible. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/docker/docker →
FAQ
Docker Engine, also known as Moby, is an open-source containerization platform that automates the deployment and management of applications within containers.
The vulnerability can lead to unintended changes in file permissions on the host's filesystem, potentially widening access to unauthorized users. However, it does not directly allow unauthorized access to read, modify, or execute files without additional cooperation from another process.
To fix this vulnerability, users should update their Docker Engine installation to version 20.10.9 or later. This version includes a fix for the bug and prevents unexpected changes to file permissions during the file copy process.
Running containers do not need to be restarted after applying the Docker Engine update. However, it is still recommended to update Docker Engine to ensure the vulnerability is addressed.
As a temporary workaround, users can reduce the risk by only running trusted containers. By carefully vetting and validating the containers used, the likelihood of exploitation can be minimized. However, this workaround is not a permanent solution and should be seen as a temporary measure until the Docker Engine update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
