Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images

An update of the docker package has been released.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21205-1 advisory.

    This update for docker-stable fixes the following issues

    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header (bsc#1260279).
    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265782).
    - CVE-2026-33997: moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plugin     installation       (bsc#1265907).
    - CVE-2026-34040: Authz zero length regression (bsc#1265929).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266625).
    - CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed     archive into       that container (bsc#1267827).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the Docker Engine (Moby) installed on the remote host is prior to 29.5.1. It is, therefore, affected by an arbitrary code execution vulnerability:

  - When a compressed archive is uploaded to a container via PUT /containers/{id}/archive or piped through docker     cp -, the daemon resolves decompression binaries (such as xz or unpigz) from the container's filesystem rather     than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized     decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID     and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container.
    (CVE-2026-41567)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2692-1 advisory.

    This update for docker fixes the following issues

    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265782).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266625).
    - CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate     validation can be       used to bypass some authorization controls (bsc#1262346).
    - CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed     archive into       that container (bsc#1267827).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21060-1 advisory.

    This update for docker fixes the following issues

    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265782).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266625).
    - CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate     validation can be       used to bypass some authorization controls (bsc#1262346).
    - CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed     archive into       that container (bsc#1267827).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to     v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or     piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from     the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious     container image containing a trojanized decompression binary can achieve arbitrary code execution with     full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a     compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and     moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using     authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding     piping compressed archives into containers created from untrusted images (CVE-2026-41567)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to
    v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or
    piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from
    the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious
    container image containing a trojanized decompression binary can achieve arbitrary code execution with
    full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a
    compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and
    moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using
    authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding
    piping compressed archives into containers created from untrusted images (CVE-2026-41567)

ID	Name	Product	Family	Severity
325084	Photon OS 4.0: Docker PHSA-2026-4.0-1050	Nessus	PhotonOS Local Security Checks	high
325040	openSUSE 16: docker-stable / docker-stable-bash-completion / etc (openSUSE-SU-2026:21205-1)	Nessus	SuSE Local Security Checks	high
324948	Docker Engine < 29.5.1 Arbitrary Code Execution	Nessus	Misc.	high
324841	SUSE SLED15: docker / docker-bash-completion / docker-buildx / etc (SUSE-SU-2026:2692-1)	Nessus	SuSE Local Security Checks	high
324067	openSUSE 16: docker / docker-bash-completion / docker-buildx / etc (openSUSE-SU-2026:21060-1)	Nessus	SuSE Local Security Checks	high
320818	Linux Distros Unpatched Vulnerability : CVE-2026-41567	Nessus	Misc.	high
442038	SCA: security update for github.com/moby/moby/v2 (GHSA-x86f-5xw2-fm2r)	Tenable Cloud Security	SCA Checks	high
442038	SCA: security update for github.com/moby/moby/v2 (GHSA-x86f-5xw2-fm2r)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-41567

high

Tenable Plugins

high

high

high

high

high

high

high

high