Critical docker engine flaw allows attackers to bypass authorization plugins

General
1

Tracked as CVE-2024-41110, the bypass and privilege escalation vulnerability carries a CVSS score of 10.0, indicating maximum severity.

“An attacker could exploit a bypass using an API request with Content-Length set to 0, causing the Docker daemon to forward the request without the body to the AuthZ plugin, which might approve the request incorrectly,” the Moby Project maintainers said in an advisory.

Have anyone any info about is it resolved or not?

2

It’s right on the page you linked:

Patched versions
. > v23.0.14, > v26.1.4, > v27.1.0

2 Likes
3

Even though it should be obvious, I will still mention it:
Only installations that actually use an AuthZ plugin are affected .

3 Likes