High severity · published Mar 31, 2026
CVE-2026-33997
Moby: Off-by-one error in plugin privilege validation
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
moby · moby
< 29.3.1 · source: vendor
EN
Engine · Docker
before 29.3.1 · source: NVD
ME
Multicluster Engine for Kubernetes · Red Hat
All versions, or not specified · source: CISA
MG
Multicluster Global Hub 1.4.5 · Red Hat
All versions, or not specified · source: CISA
MG
Multicluster Global Hub 1.6.5 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift Container Platform 4 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat multicluster global hub 1.5.3 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33997
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33997
Release Notes
https://github.com/moby/moby/releases/tag/docker-v29.3.1
Vendor Advisory
https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:21769
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:22347
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:23345
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-33997
More from moby
7.8
CVE-2026-34040
Moby: AuthZ plugin bypass with oversized request body
7.6
CVE-2026-92543
Docker Engine insecure-registry fallback via malicious DNS responses
7.2
CVE-2026-42306
Moby: Race condition in docker cp allows bind mount redirection to host path
6.1
CVE-2026-41568
Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap
