All vulnerabilities
CVE-2026-92542GHSA-6m9p-4h64-m6vh

Docker Engine: Blind VXLAN injection into encrypted overlay networks from cluster peer

Docker Docker EngineContainers & cloud
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.07%Chance of exploitation activity in the next 30 days, higher than 0% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in25.0.19Also 29.8.2CVE List
Published7 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encrypted with the overlay-network IPsec parameters which meets the following criteria:

  • UDP datagram
  • Destination port is the Swarm data-path port
  • Datagram starts with a VXLAN header for the VNI of an encrypted overlay network which any running container on the node is connected to

Text from GitHub Advisory Database

Affected versions 8

  • Docker Engineaffected: all versions before 25.0.19CVE List
  • Docker Engineaffected: 26.0.0 before 29.8.2CVE List
  • Docker Engine overlay network driveraffected: all versions before v25.0.19CVE List
  • Docker Engine overlay network driveraffected: v26.0.0 and laterCVE List
  • Moby overlay network driveraffected: v2.0.0-beta.0 before v2.0.0-beta.25CVE List
  • github.com/moby/moby/v2/daemon/libnetwork/drivers/overlay, go<= v2.0.0-beta.24GitHub
  • github.com/docker/docker/libnetwork/drivers/overlay, go<= v25.0.18, > v26.0.0GitHub
  • Docker Engine<= 25.0.18, 26.0.0 - 29.8.1GitHub

References 1