- The Mess: Docker Engine has a CVSS 8.8 authorization bypass in its AuthZ plugin layer. An oversized API request can reach the authorization plugin without its request body, potentially making the plugin approve an operation it should have blocked.
The bug is tracked as CVE-2026-34040 and is an incomplete fix for the older CVE-2024-41110 regression. Docker patched it in Engine 29.3.1 on March 25, but fresh technical research is putting the flaw back under the microscope.
- The Damage: In affected deployments, an attacker who already has limited Docker API access could bypass policy controls and potentially reach privileged container operations, turning a policy bypass into host-level impact.
The catch matters: this is not a vulnerability in every Docker installation. Docker says systems without AuthZ plugins are not affected. The risk is concentrated in environments where an authorization plugin inspects Docker API request bodies before allowing operations.
That still makes this nasty for shared infrastructure. The authorization layer is supposed to be the final guardrail. If the guardrail sees an empty request while the daemon processes the real one, the policy is effectively making a decision on a lie.
- The Fix: Upgrade Docker Engine to 29.3.1 or later and restrict access to the Docker API to trusted users and services.
Docker’s current release documentation confirms CVE-2026-34040 was fixed in 29.3.1.
Bugstoday’s Opinion
This is exactly the kind of bug that makes security teams nervous: no memory corruption, no exotic exploit chain, just two components disagreeing about what they received.
The daemon sees the request.
The security plugin doesn’t.
That’s enough.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- Docker Engine security advisory
- Docker Engine 29.3.1 release notes
- NVD / CVE-2026-34040
- GitLab Advisory Database
- Cyera Research Labs
