CVE-2026-41567: Docker: `PUT /containers/{id}/archive` executes container binary on the host

Synopsis

A path-confusion vulnerability in Docker's archive-upload path allows a malicious container image to hijack decompression binary resolution. When the Docker daemon processes a compressed archive uploaded via `PUT /containers/{id}/archive` or `docker cp -`, it incorrectly resolves binaries such as `xz` or `unpigz` from the container filesystem instead of the host filesystem. An attacker who controls the container image and can induce a user to upload a compressed archive gains arbitrary code execution with full Docker daemon privileges, including host root UID and unrestricted Linux capabilities. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Docker Engine 29.5.1 or moby v2.0.0-beta.14 reaches general availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host, or control over a container image; no network-level access to the daemon is required beyond whatever channel is used to deliver the archive.

• AuthenticationRequired

  A low-privilege account with permission to call the Docker API (for example, membership in the docker group) is sufficient to trigger the vulnerable code path.

• Victim interactionRequired

  A user with Docker API access must actively upload a compressed archive into the malicious container, for example via `docker cp` or a direct `PUT /containers/{id}/archive` call, making this a social-engineering or workflow-abuse vector.

• Attack complexityDetail

  Exploitation depends on environmental factors: the attacker must pre-position a trojanized decompression binary inside the container image before the archive upload occurs, raising the setup bar above a trivial one-step exploit.

Blast Radius

• A successful attacker executes arbitrary binaries with the Docker daemon's privileges, which on typical deployments means host root UID.
• Full Linux capabilities available to the daemon (including CAP_SYS_ADMIN) are accessible to the injected payload, enabling host filesystem reads and writes.
• The attacker can read sensitive host files such as SSH keys, secrets mounted into other containers, and credential stores accessible to root.
• Container isolation is fully bypassed, so the attacker can inspect, modify, or kill any other container running on the same host.