https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:47:09 +0000 https://db.gcve.eu/vuln/ghsa-pxq6-2prw-chj9 <p><strong>Affected:</strong> Go: github.com/docker/docker, Go: github.com/moby/moby/v2, Go: github.com/moby/moby</p> <p>## Summary</p> <p>A security vulnerability has been detected that allows [plugins](https://docs.docker.com/engine/extend/legacy_plugins/) privilege validation to be bypassed during `docker plugin install`. Due to an error in the daemon&#39;s privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user.</p> <p>Plugins that request exactly one privilege are also affected, because no comparison is performed at all.</p> <p>## Impact</p> <p>**If plugins are not in use, there is no impact.**</p> <p>When a plugin is installed, the daemon computes the privileges required by the plugin&#39;s configuration and compares them with the privileges approved during installation. A malicious plugin can exploit this bug so that the daemon accepts privileges that differ from what was intended to be approved.</p> <p>Anyone who depends on the plugin installation approval flow as a meaningful security boundary is potentially impacted.</p> <p>Depending on the privilege set involved, this may include highly sensitive plugin permissions such as broad device access.</p> <p>**For consideration: exploitation still requires a plugin to be installed from a malicious source, and Docker plugins are relatively uncommon. Docker Desktop also does not support plugins.**</p> <p>## Workarounds</p> <p>If unable to update immediately: - Do not install plugins from untrusted sources - Carefully review all privileges requested during `docker plugin install` - Restrict access to the Docker daemon to trusted parties, foll…</p> <p><strong>Affected:</strong> Go: github.com/docker/docker, Go: github.com/moby/moby/v2, Go: github.com/moby/moby</p> <p>## Summary</p> <p>A security vulnerability has been detected that allows [plugins](https://docs.docker.com/engine/extend/legacy_plugins/) privilege validation to be bypassed during `docker plugin install`. Due to an error in the daemon&#39;s privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user.</p> <p>Plugins that request exactly one privilege are also affected, because no comparison is performed at all.</p> <p>## Impact</p> <p>**If plugins are not in use, there is no impact.**</p> <p>When a plugin is installed, the daemon computes the privileges required by the plugin&#39;s configuration and compares them with the privileges approved during installation. A malicious plugin can exploit this bug so that the daemon accepts privileges that differ from what was intended to be approved.</p> <p>Anyone who depends on the plugin installation approval flow as a meaningful security boundary is potentially impacted.</p> <p>Depending on the privilege set involved, this may include highly sensitive plugin permissions such as broad device access.</p> <p>**For consideration: exploitation still requires a plugin to be installed from a malicious source, and Docker plugins are relatively uncommon. Docker Desktop also does not support plugins.**</p> <p>## Workarounds</p> <p>If unable to update immediately: - Do not install plugins from untrusted sources - Carefully review all privileges requested during `docker plugin install` - Restrict access to the Docker daemon to trusted parties, foll…</p> https://db.gcve.eu/vuln/ghsa-pxq6-2prw-chj9