CVE-2026-115538: Docker Engine overlay-network encryption rules are not restored after a firewalld reload
This Docker advisory covers CVE-2026-115538 in Docker Engine and Moby.
- CVE-2026-115538
Key facts
- Vendor rating
- High, CVSS 7
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L· base score 7, scored by DockerAttack vector: network. Attack complexity: low. Attack requirements: present. Privileges required: none. User interaction: none. Confidentiality impact on the vulnerable system: none. Integrity impact on the vulnerable system: none. Availability impact on the vulnerable system: none. Confidentiality impact on subsequent systems: high. Integrity impact on subsequent systems: high. Availability impact on subsequent systems: low.- Weakness
- CWE-693: Protection Mechanism Failure
- CISA KEV
- Not listed (catalogue checked )
- Affected
- Docker Engine before 29.9.3; Moby before v2.0.0-beta.29
- Fixed in
- 29.9.3, v2.0.0-beta.29
- Source published
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload or start signals over D-Bus.
The missing rules cause outgoing VXLAN datagrams to bypass IPsec encryption and remove the protection against incoming cleartext VXLAN traffic. The condition is not logged by dockerd and persists until the encrypted network's last local endpoint is removed and another is added, or dockerd is restarted.
Each further firewalld event repeats the condition.
Text from the source record.
- Docker Engine before 29.9.3
- Moby before v2.0.0-beta.29
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2026-115538
Upgrade to a fixed release named by Docker:
- 29.9.3
- v2.0.0-beta.29
Vendor guidance
- The missing rules cause outgoing VXLAN datagrams to bypass IPsec encryption and remove the protection against incoming cleartext VXLAN traffic.
End-of-life dates for Docker Engine
More Docker advisories
CVE-2026-115539Nov 10, 2026Cluster-API proxy overwrites forwarded client identity with its ownCVE-2026-92543Oct 7, 2026Docker Engine classifies a registry hostname as insecure using an any-match DNS checkCVE-2026-42306Jun 12, 2026Docker Engine: Moby is an open source container frameworkCVE-2026-17106Aug 18, 2026The tar extraction routines in moby/go-archiveCVE-2026-41567Jun 5, 2026Docker Engine: Moby is an open source container frameworkCVE-2026-123082Nov 10, 2026Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access
Get an email when Docker Engine / Moby publishes the next one.
See Docker Engine / Moby's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Docker CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
