FIND-20260402-002 · 2026-04-02 · Innovation Veille

CVE-2026-34040: Docker AuthZ plugin bypass via oversized request bodies — PATCHED in v29.3.1

cve HIGH
HIGH (CVSS 8.8) incomplete fix for CVE-2024-41110. Attackers can bypass Docker AuthZ plugins by sending oversized request bodies that cause the plugin to skip authorization checks under specific conditions. Affects Moby/Docker prior to 29.3.1. ODS runs Docker Engine 29.3.1 — the patch is already in place. The vulnerability was last modified 2026-03-31. This is a repeat pattern (second bypass of the same AuthZ plugin mechanism) indicating structural weakness in Docker's authorization plugin architecture.

Source

https://vulnerability.circl.lu/vuln/cve-2026-34040

ODS Impact

ODS infrastructure uses Docker on both srv-agents and srv-staging (Coolify PaaS). All containers, including oid, docstore, redpanda, and postgres, are managed by Docker. AuthZ plugins are not explicitly used in ODS config (Coolify manages access), reducing practical exploitability. Confirm Docker version is 29.3.1+ on both servers. Consider auditing Coolify's API access patterns as a compensating control.

Security Review

License: N/A (CVE) | Maintenance: ACTIVE | Risk: LOW | Recommendation: SAFE_TO_USE

Tags

cve docker high authz container patched infrastructure