CVE-2017-20198 DC/OS Marathon UI < 1.9.0 Unauthenticated RCE via Docker Mount Abuse
Unauthenticated attackers can deploy malicious Docker containers to mount the host filesystem, achieving root code execution on DC/OS Marathon.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-20198?
CVE-2017-20198 is a critical vulnerability in D2iQ, Inc. DC/OS Marathon, published on 23 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations, attackers can deploy a container that mounts the host's root filesystem (/) with read/write privileges. When using a malicious Docker image, the attacker can write to /etc/cron.d/ on the host, achieving arbitrary code execution with root privileges. This impacts any system where the Docker daemon honors Marathon container configurations without policy enforcement.
Weakness: CWE-732
Which versions are affected by CVE-2017-20198?
How do I fix CVE-2017-20198?
No fix has been published for CVE-2017-20198 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-20198 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-20198 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-24rw-3m8c-crv2.