Summary
CVE-2026-33997 is an off-by-one privilege validation error in the Moby container framework (Docker engine). During docker plugin install, the daemon compares a plugin's requested privilege set against the user-approved set incorrectly. When a plugin requests exactly one privilege, no comparison is performed at all. Affected Moby versions are before 29.3.1.
Affected Asset
Moby open-source container framework (Docker engine) before version 29.3.1; homelab Docker deployments that install plugins through the daemon (e.g., logging, networking, or storage plugins).
Affected Endpoint
Docker daemon plugin install endpoint (daemon-side privilege comparison logic in the plugin authorization handler); triggers when a user runs docker plugin install with a plugin that requests a non-matching privilege set.
Prerequisites
Host running Moby / Docker engine before 29.3.1; attacker has network access to a Docker API endpoint or can deliver a malicious plugin image; user interaction is required to trigger plugin installation (user interaction required).
Steps to Reproduce
1. Confirm Docker engine version is before 29.3.1 (docker version --format '{{.Server.Version}}'). 2. Create a malicious plugin image that requests a privilege set differing by one element from the approved set, or exactly one privilege. 3. Initiate docker plugin install <plugin> from a user account with authorization to install plugins. 4. Observe that the daemon incorrectly accepts the plugin's privilege set (either due to off-by-one comparison or missing comparison for single privileges) and activates the plugin with elevated capabilities.
Evidence
GitHub Security Advisory GHSA-pxq6-2prw-chj9; NVD entry CVE-2026-33997 (CVSS 6.8, CWE-193 Off-by-one Error); Moby release notes for v29.3.1 confirming the fix.
Impact
A malicious plugin installed with unauthorized privileges can gain elevated capabilities within the container runtime, potentially accessing host-level resources or modifying container policies that should be restricted. In homelab deployments, this may expose Docker-host interfaces through plugin-side code.
Root Cause
The daemon's privilege comparison logic uses an incorrect comparison that allows an off-by-one mismatch: when comparing two privilege lists of equal length, a miscount allows a plugin with a different set to be accepted. Additionally, when a plugin requests exactly one privilege, the comparison branch is skipped entirely, so no validation is performed. This is CWE-193: Off-by-one Error.
Remediation
Upgrade to Moby / Docker Engine 29.3.1 or later. Update instructions: apt update && apt install docker-ce (Debian-based homelabs) or pull the updated image (docker pull moby:29.3.1). Review all installed plugins for unexpected capabilities after the upgrade.
Verification Steps
Confirm engine version is 29.3.1 or newer (docker version or docker info). Inspect installed plugins (docker plugin ls) and verify each plugin's capabilities match its documentation. Monitor daemon logs for authorization errors during plugin operations.