Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access
Docker Engine has been found to have a high-severity security flaw that, under some situations, could allow an attacker to go around authorization plugins (AuthZ).
Tracked as CVE-2026-34040 (CVSS score: 8.8), the vulnerability is caused by an unfinished fix for CVE-2024-41110, a maximum-severity vulnerability in the same component that was discovered in July 2024.
In an advisory published late last month, Docker Engine maintainers stated that an attacker might force the Docker daemon to forward a specially constructed API request to an authorization plugin without the body. If the body had been sent to the authorization plugin, it might approve a request that it would have rejected otherwise.
This could affect anyone who relies on authorization plugins that make choices about acc...