CVE-2026-34040: Moby: AuthZ plugin bypass with oversized request body

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-31 · updated 2026-06-17
Weakness: CWE-288

Description

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

Affected products

Docker Engine: before 29.3.1 — fixed in 29.3.1

How to fix

Upgrade to a fixed version: Docker Engine 29.3.1. Check the vendor advisory for mitigations.

References

https://github.com/moby/moby/releases/tag/docker-v29.3.1
https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2

Get alerted when CVE-2026-34040 or the next vulnerability affects your stack