Docker Authorization Bypass Flaw Exposed Hosts to Potential Attackers

Gbhackers •Divya • April 8, 2026

A high-severity security vulnerability has been discovered in Docker Engine, exposing hosts to potential authorization bypass attacks. Tracked as CVE-2026-34040, the flaw allows attackers to evade authorization plugins (AuthZ) by manipulating API request bodies. While the base likelihood of exploitation remains low, the vulnerability carries a “High” severity rating. It specifically impacts environments relying on […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Docker Patches Critical AuthZ Bypass Vulnerability CVE-2026-34040 Docker has addressed a critical vulnerability, tracked as CVE-2026-34040, that allows attackers to bypass authorization checks and create containers with excessive privileges. The flaw arises from middleware issues in the Docker API, affecting all users regardless of the specific authorization plugin in use. An attacker can exploit this vulnerability by sending an HTTP request larger than 1MB, causing the middleware to skip authorization checks. This can lead to the creation of privileged containers that can access sensitive host data. The vulnerability is described as an incomplete fix of a previous issue (CVE-2024-41110) that was not fully addressed in patches. Docker has increased the maximum body size limit to 4MB and implemented measures to reject oversized requests. Users are advised to update to Docker Engine version 29.3.1 or later to mitigate risks. The flaw poses significant risks in enterprise environments where sensitive data is managed through Docker containers. 4 sources 74

Extracted Entities

CVEs (1)

CVE-2026-34040

Platforms (1)

Docker Engine