CVE-2026-92543GHSA-7cfq-22r6-qp73
Docker Engine insecure-registry fallback via malicious DNS responses
Docker Docker EngineContainers & cloudCVSS
7.6HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.09%Chance of exploitation activity in the next 30 days, higher than 0% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 29.8.2Docker EngineCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Because the transport re-dials the hostname rather than the CIDR-matching address, a DNS answer set of one loopback IP plus a non-loopback attacker IP disables certificate verification and enables HTTP fallback for the registry connection.
Text from CVE List
Affected versions 4
- Docker Engineaffected: all versions before 29.8.2CVE List
- Mobyaffected: all versions before v2.0.0-beta.25CVE List
- github.com/moby/moby/v2, go< v2.0.0-beta.25GitHub
- Docker Engine< 29.8.2GitHub