CVE-2026-34040 Moby: AuthZ plugin bypass with oversized request body
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-34040?
CVE-2026-34040 is a high-severity vulnerability in moby, published on 31 Mar 2026.
Official description
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.
Weakness: CWE-288
Which versions are affected by CVE-2026-34040?
7 open source packages ship an affected version, including github.com/moby/moby, github.com/docker/docker and github.com/moby/moby/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/moby/moby Go | All versions | None |
github.com/moby/moby Go | All versions | 29.3.1 |
github.com/moby/moby Go | All versions | 29.3.1 |
github.com/docker/docker Go | All versions | None |
github.com/moby/moby/v2 Go | All versions | 2.0.0-beta.8 |
github.com/moby/moby/v2 Go | All versions | 2.0.0-beta.8 |
1 more packages
github.com/moby/moby/v2 Go | All versions | 2.0.0-beta.8 |
Products include Docker Engine.
How do I fix CVE-2026-34040?
Upgrade github.com/moby/moby to 29.3.1 or later.
Is CVE-2026-34040 being exploited?
There is no known exploitation of CVE-2026-34040 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in moby
- CVE-2026-42306 Moby: Race condition in docker cp allows bind mount redirection to host path
- CVE-2026-33997 Moby: Off-by-one error in plugin privilege validation
- CVE-2026-41568 Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap
- CVE-2018-20699 Denial of service in n/a
Sources
Also known as BELL-CVE-2026-34040, CLEANSTART-2026-GL76811, CLEANSTART-2026-LO90472, CLEANSTART-2026-RR21163, CLEANSTART-2026-TC24088, CLEANSTART-2026-YI67273 and 271 more.