Summary
CVE-2026-34040 is an authorization plugin bypass in Docker Engine (Moby) before 29.3.1. When a container-creation API request body exceeds ~1 MB, the AuthZ middleware silently drops it before forwarding to the authorization plugin. The plugin sees an empty request and approves; the daemon processes the full payload and creates a privileged container with host filesystem access. Affects any Docker Engine deployment using authorization plugins.
Severity
High — CVSS 3.1 base score 8.8 (AV:L / AC:L / PR:L / UI:N / S:C / C:H / I:H / A:H). NVD published 2026-03-31.
Affected Asset
Docker Engine (Moby) versions before 29.3.1; includes Docker Desktop installations that rely on the engine's authorization middleware. Any homelab or enterprise deployment using authorization plugins (OPA, Prisma Cloud, Casbin, or custom) is affected when the plugin is configured to inspect request bodies.
Affected Endpoint
Docker daemon authorization middleware (`/containers/create` and related container-management endpoints). Attack vector: single oversized HTTP POST body (>1 MB) to the Docker API.
Prerequisites
Docker Engine version < 29.3.1; authorization plugin configured to inspect request bodies (e.g., for privileged-mode or host-mount restrictions); attacker has network access to the Docker API endpoint (TCP/TLS) and valid low-privilege credentials restricted by the AuthZ plugin.
Steps to Reproduce
1. Confirm Docker Engine version is before 29.3.1 (docker version --format '{{.Server.Version}}'). 2. Send a padded container creation request to the Docker API with body > 1 MB (e.g., repeated dummy JSON fields or whitespace padding). 3. Include malicious flags in the full body: Privileged: true and Binds: ["/:/host"] to mount the host filesystem. 4. The AuthZ middleware truncates/drops the oversized body before it reaches the plugin; the plugin approves the empty/truncated request. 5. The daemon executes the original full payload, creating a privileged container with full host filesystem access.
Evidence
NVD entry CVE-2026-34040 (CVSS 8.8, CWE-288 Authentication Bypass); MITRE cveawg.mitre.org record; GitHub Security Advisory GHSA-x744-4wpc-v9h2; Moby release notes v29.3.1 confirming fix (changed middleware to fail-closed with 4 MB limit); Cyera Research Labs technical disclosure (published Aug 2026) confirming exploitation chain and plug-in-agnostic behavior.
Impact
Full host compromise from any Docker API user restricted by an authorization plugin. A single oversized HTTP request bypasses all body-inspecting plugins (OPA, Prisma Cloud, Casbin, custom). A privileged container grants root access to the host filesystem, exposing AWS keys, SSH keys, Kubernetes configs, database credentials, and any other host-level secrets.
Root Cause
CWE-288 / CWE-863: The Docker authorization middleware uses a fail-open design. When the request body exceeds ~1 MB, the middleware silently drops the body before forwarding to the AuthZ plugin (`drainBody()` behavior). The plugin sees an empty or truncated request, finds nothing to block, and approves. The daemon then processes the original, intact request — including malicious flags — without any authorization check against the full body.
Remediation
Upgrade Docker Engine to 29.3.1 or later; upgrade Docker Desktop to 4.66.1 or later. The fix raises the body size limit to 4 MB and changes the middleware to fail-closed (explicit error instead of silent drop). Additional hardening: restrict Docker API access to trusted users/services; run Docker in rootless mode; use --userns-remap to limit blast radius; audit AuthZ plugin logs for unusually large request bodies; avoid relying solely on AuthZ plugins for security-critical authorization decisions.
Verification Steps
Confirm engine version is 29.3.1 or newer (docker version or docker info). Verify the middleware fix is active: oversized requests (>4 MB) now return an explicit authorization error rather than being silently processed. Review plugin configurations to confirm body inspection is still enabled. Monitor daemon logs for rejected oversized requests. If rootless mode is enabled, confirm user namespace remapping is active (cat /etc/subuid / cat /etc/subgid).