{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-92542 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-92542 is a medium-severity vulnerability in Docker Engine, published on 7 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-92542 and fix it if it is affected.\n\nWhat it is: CVE-2026-92542 is a medium-severity vulnerability in Docker Engine, published on 7 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-92542 in the wild and no public exploit code.\n\nAffected product: Docker Engine. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-92542/ (Markdown: https://insights.sbomify.com/CVE-2026-92542/index.md)","id":"CVE-2026-92542","markdown":"https://insights.sbomify.com/CVE-2026-92542/index.md","name":"CVE-2026-92542","record":{"aliases":["AZL-107739","BELL-CVE-2026-92542","DEBIAN-CVE-2026-92542","ECHO-a2cc-0616-7d9c","GHSA-6m9p-4h64-m6vh","UBUNTU-CVE-2026-92542"],"analysis":{"component_type":"container_or_infrastructure","fix_type":"patch","impacts":["security_bypass","data_read"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Docker Swarm overlay network","requires_auth":"low_privilege","summary":"Attackers can inject blind VXLAN traffic into encrypted Docker Swarm overlay networks, bypassing IPsec encryption protections.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Docker","cpe":[],"cvss":{"score":6.9,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-290","name":"Authentication Bypass by Spoofing"}],"description":"The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encrypted with the overlay-network IPsec parameters which meets the following criteria:\n\n- UDP datagram\n- Destination port is the Swarm data-path port\n- Datagram starts with a VXLAN header for the VNI of an encrypted overlay network which any running container on the node is connected to","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Blind VXLAN injection into encrypted overlay networks from cluster peer","id":"CVE-2026-92542","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"security_feature_bypass","year":"2026"},"n_packages":0,"n_references":1,"next":{"headline":"Docker Engine insecure-registry fallback via malicious DNS responses","id":"CVE-2026-92543"},"packages":[],"prev":{"headline":"Import and export users and customers \u003c 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer","id":"CVE-2026-92541"},"products":["Docker Engine","Docker Engine overlay network driver","Moby overlay network driver"],"published":"2026-10-07","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-07","vendors":["Docker","Moby"]},"summary":"Attackers can inject blind VXLAN traffic into encrypted Docker Swarm overlay networks, bypassing IPsec encryption protections.","url":"https://insights.sbomify.com/CVE-2026-92542/"}