CVE-2026-41567 Docker: `PUT /containers/{id}/archive` executes container binary on the host
A malicious container image can execute arbitrary code on the host with root privileges when a user uploads a compressed archive to it.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-41567?
CVE-2026-41567 is a high-severity code injection vulnerability in Docker Engine, published on 5 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images
Weakness: CWE-427
Which versions are affected by CVE-2026-41567?
9 open source packages ship an affected version, including github.com/docker/docker, github.com/moby/moby and github.com/moby/moby/v2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/docker/docker Go | All versions | None |
github.com/docker/docker Go | All versions to 28.5.2 | None |
github.com/docker/docker Go | All versions to 28.5.2 | None |
github.com/moby/moby Go | All versions | None |
github.com/moby/moby Go | All versions to 28.5.2 | None |
github.com/moby/moby Go | All versions to 28.5.2 | None |
3 more packages
github.com/moby/moby/v2 Go | All versions | 2.0.0-beta.14 |
github.com/moby/moby/v2 Go | All versions | 2.0.0-beta.14 |
github.com/moby/moby/v2 Go | All versions | 2.0.0-beta.14 |
How do I fix CVE-2026-41567?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-41567 being exploited?
There is no known exploitation of CVE-2026-41567 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as BELL-CVE-2026-41567, CLEANSTART-2026-AC15686, DEBIAN-CVE-2026-41567, ECHO-5d94-d6eb-c1ed, GHSA-x86f-5xw2-fm2r, GO-2026-5746 and 265 more.