Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6443 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6443-1                   security@debian.org     https://www.debian.org/security/                                  Aron Xu     August 16, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : docker.io     CVE ID         : CVE-2026-33747 CVE-2026-33748 CVE-2026-33997 CVE-2026-34040                      CVE-2026-41567 CVE-2026-41568 CVE-2026-42306

    Multiple vulnerabilities were discovered in the Docker container engine     and in the bundled BuildKit build toolkit, which may result in privilege     escalation, arbitrary file access on the host, or bypass of authorization     policies.

    For the stable distribution (trixie), these problems have been fixed in     version 26.1.5+dfsg1-9+deb13u1.

    We recommend that you upgrade your docker.io packages.

    For the detailed security status of docker.io please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/docker.io

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon     versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker     cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute     paths on the host filesystem. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon     version 2.0.0-beta.14. (CVE-2026-41568)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon
    versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker
    cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute
    paths on the host filesystem. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon
    version 2.0.0-beta.14. (CVE-2026-41568)

ID	Name	Product	Family	Type	Severity
349325	Debian dsa-6443 : docker-cli - security update	Nessus	Debian Local Security Checks	Local	high
320981	Linux Distros Unpatched Vulnerability : CVE-2026-41568	Nessus	Misc.	Local	medium
442028	SCA: security update for github.com/moby/moby/v2 (GHSA-vp62-88p7-qqf5)	Tenable Cloud Security	SCA Checks	Local	medium
442028	SCA: security update for github.com/moby/moby/v2 (GHSA-vp62-88p7-qqf5)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-41568

medium

Tenable Plugins

high

medium

medium

medium