CVE-2026-92543 Docker Engine insecure-registry fallback via malicious DNS responses
Attackers can bypass TLS certificate verification for Docker registries by manipulating DNS responses to include a loopback address, enabling man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-92543?
CVE-2026-92543 is a high-severity vulnerability in Docker Engine, published on 7 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Because the transport re-dials the hostname rather than the CIDR-matching address, a DNS answer set of one loopback IP plus a non-loopback attacker IP disables certificate verification and enables HTTP fallback for the registry connection.
Which versions are affected by CVE-2026-92543?
How do I fix CVE-2026-92543?
Apply the vendor's patch.
Is CVE-2026-92543 being exploited?
There is no known exploitation of CVE-2026-92543 in the wild and no public exploit code.
Sources
Also known as AZL-107195, AZL-107315, AZL-107333, AZL-107351, AZL-107748, BELL-CVE-2026-92543 and 9 more.