CVE-2026-115539: Docker: SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity
This Docker advisory covers CVE-2026-115539 in SwarmKit, Docker Engine and Moby.
- CVE-2026-115539
Key facts
- Vendor rating
- High, CVSS 7.7
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N· base score 7.7, scored by DockerAttack vector: network. Attack complexity: low. Attack requirements: present. Privileges required: low. User interaction: none. Confidentiality impact on the vulnerable system: high. Integrity impact on the vulnerable system: high. Availability impact on the vulnerable system: high. Confidentiality impact on subsequent systems: none. Integrity impact on subsequent systems: none. Availability impact on subsequent systems: none.- Weakness
- CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
- CISA KEV
- Not listed (catalogue checked )
- Affected
- SwarmKit before 2.1.3; Docker Engine 23.0.0; Moby through 2.0.0-beta.28 and 1 more below
- Fixed in
- 1.39
- Source published
- Source revised
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when built with grpc-go 1.39 or later.
During a short window after a leader change, two proxy hops through managers with inconsistent views of the leader can allow an attacker possessing a valid worker node TLS certificate and private key to obtain a manager node certificate for the attacker's own key, escalating privileges from worker to manager.
Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted.
Affected product named by the advisory: Docker.
Affected products named by the advisory: Docker Engine; Moby.
Text from the source record.
- SwarmKit before 2.1.3
- Docker Engine 23.0.0
- Moby through 2.0.0-beta.28
- SwarmKit 1.12.1-0.20220307221335-616e8db4c3b0
NVD record · high-confidence parse· fetched ·verify at source
How to fix CVE-2026-115539
Upgrade to a fixed release named by Docker:
- 1.39
End-of-life dates for Docker Engine
More Docker advisories
CVE-2026-115538Nov 10, 2026Docker Engine: Moby's overlay network driver does not restore the iptables rulesCVE-2026-92543Oct 7, 2026Docker Engine classifies a registry hostname as insecure using an any-match DNS checkCVE-2026-42306Jun 12, 2026Docker Engine: Moby is an open source container frameworkCVE-2026-17106Aug 18, 2026The tar extraction routines in moby/go-archiveCVE-2026-41567Jun 5, 2026Docker Engine: Moby is an open source container frameworkCVE-2026-123082Nov 10, 2026Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access
Get an email when Docker Engine / Moby publishes the next one.
See Docker Engine / Moby's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Docker CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
