🛡️ CVE-2026-42306 on Go (Root.io) — docker

Distribution advisory

This page covers CVE-2026-42306 as tracked by Go (Root.io), for the package docker. The fix is available in version v28.5.2+incompatible-aikido.4; earlier versions remain affected.

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is high, an attacker needs low-level privileges on the target. A user must be tricked into taking some action. The scope is changed, meaning a successful attack can affect components beyond the vulnerable one. Rated impact: confidentiality none, integrity high, availability high.

CVSS metrics in full

The score comes from this vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H

• Attack vector: Local — a local account, shell or session on the host is needed.
• Attack complexity: High — the attacker first has to win a race, learn a secret or otherwise prepare the target.
• Privileges required: Low — an ordinary user account is enough.
• User interaction: Required — someone has to click, open or visit something.
• Scope: Changed — a successful attack reaches components beyond the vulnerable one.
• Confidentiality impact: None.
• Integrity impact: High — total loss, or loss the attacker controls.
• Availability impact: High — total loss, or loss the attacker controls.

Weakness class

ROOT-APP-GOBINARY-CVE-2026-42306 is classified as CWE-61: UNIX Symbolic Link (Symlink) Following. The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere.

Affected software

ROOT-APP-GOBINARY-CVE-2026-42306 is recorded against 2 packages.

• github.com/docker/docker (fixed in v28.5.2+incompatible-aikido.4)
• rootio-github.com/docker/docker (fixed in v28.5.2-root.io.7+incompatible)

Timeline and source

Published on 22 June 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

Other advisories for this package

github.com/docker/docker has other advisories on record. If you are patching this one, these are worth checking on the same host:

• CVE-2026-41568 (published 25 Jun 2026)
• CVE-2026-41567 (8.0 High, published 25 Jun 2026)
• ROOT-APP-GOBINARY-CVE-2026-33997 (5.0 Medium, published 22 Jun 2026)
• ROOT-APP-GOBINARY-CVE-2026-34040 (8.0 High, published 22 Jun 2026)
• CVE-2026-42306 (8.0 High, published 18 May 2026)
• CVE-2026-34040 (8.0 High, published 2 Apr 2026)
• CVE-2026-33997 (published 2 Apr 2026)
• ECHO-91b4-e7d6-f02c (published 30 Mar 2026)

Same weakness in other software

These advisories are the same class of weakness (CWE-61: UNIX Symbolic Link (Symlink) Following) in other software:

• CVE-2026-47763 (published 4 Aug 2026)
• CVE-2026-54574 (8.2 High, published 29 Jul 2026)
• CVE-2026-56748 (8.8 High, published 27 Jul 2026)
• CVE-2026-65010 (6.6 Medium, published 23 Jul 2026)
• CVE-2026-12080 (7.3 High, published 20 Jul 2026)
• CVE-2026-59674 (published 14 Jul 2026)
• CVE-2026-39822 (7.8 High, published 8 Jul 2026)
• CVE-2026-23968 (5.5 Medium, published 7 Jul 2026)

CVE-2026-42306 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Details

Affected Packages

References