Skip to content

[Aikido] Fix 5 security issues in docker/docker, go.mongodb.org/mongo-driver#63

Open
aikido-autofix[bot] wants to merge 1 commit into
masterfrom
fix/AIK-11350-AIK-15451-update-packages-52456427-e7cr
Open

[Aikido] Fix 5 security issues in docker/docker, go.mongodb.org/mongo-driver#63
aikido-autofix[bot] wants to merge 1 commit into
masterfrom
fix/AIK-11350-AIK-15451-update-packages-52456427-e7cr

Conversation

@aikido-autofix

Copy link
Copy Markdown

Upgrade Docker and MongoDB drivers to fix authorization bypass, privilege validation bypass, docker cp race conditions enabling arbitrary file operations, and heap buffer overflow vulnerabilities.

✅ 5 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2026-34040
HIGH
[github.com/docker/docker] Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.
CVE-2026-33997
HIGH
[github.com/docker/docker] A privilege validation bypass in plugin installation allows the daemon to incorrectly accept unapproved privilege sets due to flawed comparison logic, enabling plugins to gain unintended elevated permissions.
CVE-2026-42306
MEDIUM
[github.com/docker/docker] A race condition in docker cp mount setup allows a malicious container to redirect bind mount targets to arbitrary host paths, enabling arbitrary file overwriting or denial of service attacks.
CVE-2026-41568
MEDIUM
[github.com/docker/docker] A race condition in docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem, enabling local privilege escalation and host compromise.
CVE-2026-2303
MEDIUM
[go.mongodb.org/mongo-driver] Heap out-of-bounds read vulnerability in GSSAPI authentication bindings due to incorrect assumptions about string termination, allowing reading one byte past allocated buffer memory.
🔗 Related Tasks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants