CVE-2026-33997

docker engine

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-33997

Katalog CVE

CVSS 8.1 · High EPSS 0,51%

Kerentanan Off-by-one Error pada docker engine. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.

Rincian

Terbit di NVD
31 Maret 2026
Terakhir diubah
9 September 2026
Status NVD
Modified
CVSS 3.1
8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-193: Off-by-one Error
CWE-266: Incorrect Privilege Assignment
EPSS (30 hari)
0,51% peluang dieksploitasi; lebih tinggi dari 42,0% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
docker engine Semua versi sebelum 29.3.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.