CVE-2026-42306

score

<0.1

cvss

7.2

epss

0.1%

published

2026-06-12

kev added

—

first seen

2026-10-21

Moby Docker Engine < 29.5.1, Docker Daemon <= 28.5.2, and Moby Daemon < 2.0.0-beta.14 contain a race condition during docker cp mount setup, letting malicious containers redirect bind mount targets to arbitrary host paths, potentially overwriting files or causing denial of service, exploit requires container access.