{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33997", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-24T22:20:06.214Z", "datePublished": "2026-03-31T01:36:51.404Z", "dateUpdated": "2026-04-02T03:55:57.801Z"}, "containers": {"cna": {"title": "Moby: Off-by-one error in plugin privilege validation", "problemTypes": [{"descriptions": [{"cweId": "CWE-193", "lang": "en", "description": "CWE-193: Off-by-one Error", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9"}, {"name": "https://github.com/moby/moby/releases/tag/docker-v29.3.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/moby/moby/releases/tag/docker-v29.3.1"}], "affected": [{"vendor": "moby", "product": "moby", "versions": [{"version": "< 29.3.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T01:36:51.404Z"}, "descriptions": [{"lang": "en", "value": "Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1."}], "source": {"advisory": "GHSA-pxq6-2prw-chj9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-33997"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T03:55:57.801Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33997", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-31T18:51:10.366255Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T18:51:11.404Z"}}], "cna": {"title": "Moby: Off-by-one error in plugin privilege validation", "source": {"advisory": "GHSA-pxq6-2prw-chj9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "moby", "product": "moby", "versions": [{"status": "affected", "version": "< 29.3.1"}]}], "references": [{"url": "https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9", "name": "https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/moby/moby/releases/tag/docker-v29.3.1", "name": "https://github.com/moby/moby/releases/tag/docker-v29.3.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-193", "description": "CWE-193: Off-by-one Error"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T01:36:51.404Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33997", "state": "PUBLISHED", "dateUpdated": "2026-04-02T03:55:57.801Z", "dateReserved": "2026-03-24T22:20:06.214Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-31T01:36:51.404Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1."}, {"lang": "es", "value": "Moby es un framework de contenedor de c\u00f3digo abierto. Antes de la versi\u00f3n 29.3.1, se ha detectado una vulnerabilidad de seguridad que permite omitir la validaci\u00f3n de privilegios de los plugins durante docker plugin install. Debido a un error en la l\u00f3gica de comparaci\u00f3n de privilegios del demonio, este puede aceptar incorrectamente un conjunto de privilegios que difiere del aprobado por el usuario. Los plugins que solicitan exactamente un privilegio tambi\u00e9n se ven afectados, porque no se realiza ninguna comparaci\u00f3n en absoluto. Este problema ha sido parcheado en la versi\u00f3n 29.3.1."}], "id": "CVE-2026-33997", "lastModified": "2026-04-01T14:24:02.583", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-03-31T03:15:57.523", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/moby/moby/releases/tag/docker-v29.3.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-193"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plugin installation", "id": "2453277", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453277"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-266", "details": ["Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.", "A flaw was found in Moby, an open-source container framework. This vulnerability allows for a privilege validation bypass during `docker plugin install`. Due to an error in the daemon's privilege comparison logic, the system may incorrectly accept a plugin's requested privileges that differ from those approved by the user. This could lead to unauthorized privilege escalation for installed plugins."], "name": "CVE-2026-33997", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "multicluster-engine/assisted-service-8-rhel8", "product_name": "Multicluster Engine for Kubernetes"}, {"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "multicluster-engine/assisted-service-9-rhel9", "product_name": "Multicluster Engine for Kubernetes"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:service_mesh:2", "fix_state": "Not affected", "package_name": "openshift-service-mesh/istio-rhel8-operator", "product_name": "OpenShift Service Mesh 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/acm-grafana-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-agent-installer-api-server-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-agent-installer-api-server-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-console", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:container_native_virtualization:4", "fix_state": "Affected", "package_name": "container-native-virtualization/hostpath-provisioner-operator-rhel9", "product_name": "Red Hat OpenShift Virtualization 4"}], "public_date": "2026-03-31T01:36:51Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-33997\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33997\nhttps://github.com/moby/moby/releases/tag/docker-v29.3.1\nhttps://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,29.3.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "moby", "source": "cna", "vendor": "moby"}, "product": "moby", "vendor": "moby"}], "analysis": {"en": {"generated_at": "2026-03-31T05:24:24.993394+00:00", "value": {"mitigation_remediation": ["Upgrade the Docker (Moby) daemon to version 29.3.1 or newer."], "summary": {"action": "Apply Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "All installations of the Moby framework prior to version 29.3.1 are susceptible. This includes any deployment where the Docker daemon (Moby) is running version 29.2.x or earlier, as the fix was introduced in 29.3.1.", "description_and_impact": "Moby, the open source container framework, has a validation flaw in its plugin privilege handling. During a plugin install, the daemon incorrectly compares the privilege set presented by the plugin with the set approved by the user, accepting a set that differs from the one the user intended. Because plugins that request exactly one privilege trigger no comparison at all, an attacker can install a plugin that has higher privileges than the user granted. An attacker who gains this ability can execute privileged container operations or potentially elevate privileges on the host if the plugin misuses its granted capabilities. The vulnerability is classified as a privilege escalation flaw.", "risk_and_exploitability": "The CVSS score for this flaw is 6.8, indicating a medium\u2011level severity. The EPSS score is not available, so the exact likelihood of exploitation is unclear, but the flaw exists in the core daemon and can be triggered simply by installing a plugin. The vulnerability is not listed in CISA\u2019s KEV catalog, suggesting it has not yet been widely exploited in the wild. An attacker must be able to submit a plugin for installation or otherwise influence the plugin install process. Once the daemon is updated to version 29.3.1 or later, the bug is fixed and exploitation is no longer possible."}}}}, "created": "2026-03-31T19:56:29.512563+00:00", "updated": "2026-03-31T20:39:40.134347+00:00", "vendors": ["moby", "moby$PRODUCT$moby"]}