CVE-2026-92543
Description
A flaw was found in Docker Engine. This vulnerability can lead to information disclosure or container image tampering by allowing an attacker to intercept unencrypted registry traffic. The flaw exists because the engine disables Transport Layer Security (TLS) certificate verification if any resolved address of a registry hostname matches a trusted local loopback network. A remote attacker capable of manipulating Domain Name System (DNS) responses can inject a loopback address alongside an external server address, tricking the client into connecting to an attacker-controlled registry over insecure HTTP.
Statement
This vulnerability is rated as an Important severity flaw because successful exploitation allows an attacker to intercept registry communications and inject untrusted container images or capture sensitive credentials. Exploitation requires high attack complexity, as the adversary must actively manipulate DNS responses to return a loopback IP alongside a target remote IP. While Red Hat core container runtimes primarily rely on Podman and CRI-O rather than the Docker Engine daemon, certain platform utilities and embedded management tools that integrate Moby container client logic remain exposed.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.4 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Integrity,Authentication
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
