Skip to content
Threat Feed

Product

Docker/Docker (<= 28.5.2)

1 brief RSS
high threat

Docker Race Condition Allows Bind Mount Redirection to Host Path (CVE-2026-42306)

A race condition in Docker's `docker cp` command allows a malicious container to redirect a bind mount target to an arbitrary host path by manipulating symlinks during the setup of temporary filesystem views, potentially overwriting host files or causing denial of service.

docker/docker +2 privilege-escalation defense-evasion docker
2r 2t