CVE-2026-42306: Moby: Race condition in docker cp allows bind mount redirection to host path

Synopsis

A race condition in Moby (the open source container framework underlying Docker Engine) allows a low-privileged local attacker with the ability to run containers to redirect a bind mount during a docker cp operation to an arbitrary host path. The exploit requires network-adjacent or local access, a low-privilege account, victim interaction, and timing precision due to the race window. Successful exploitation lets an attacker overwrite arbitrary files on the host or crash the Docker daemon, achieving integrity damage or denial of service. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream publishes a stable fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the service is required.

• AuthenticationRequired

  Any low-privilege account with permission to run containers is sufficient; no admin credentials are needed.

• Victim interactionRequired

  A user or automation with sufficient privileges must execute a docker cp operation against the malicious container for the race window to open.

• Attack complexityDetail

  Exploitation depends on winning a race condition during bind mount setup, requiring precise timing and likely repeated attempts.

Blast Radius

• Overwrites arbitrary files on the container host, including binaries, configuration files, or credentials.
• Corrupts or replaces host-side files in a way that persists after the container exits.
• Causes the Docker daemon to crash, taking down all containers on the affected host.
• Disrupts the availability of workloads running on the same host by destabilizing the daemon process.