ALPINE-CVE-2026-115539: High severity alpine/docker vulnerability
SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when built with grpc-go 1.39 or later. During a short window after a leader change, two proxy hops through managers with inconsistent views of the leader can allow an attacker possessing a valid worker node TLS certificate and private key to obtain a manager node certificate for the attacker's own key, escalating privileges from worker to manager. Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/dockerto a version that resolves this vulnerability.Fixed in 29.9.3-r0
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted. Exploitation involves the Cluster-API proxy and manager nodes during a leader transition.
What does an attacker need to exploit this issue?
The attacker needs a valid worker node TLS certificate and its private key. They also need a short period after a leader change in which two manager proxy hops have inconsistent views of the leader.
What is the resulting impact if exploitation succeeds?
An attacker can obtain a manager node certificate for their own key, escalating privileges from worker to manager. The reported impact includes high confidentiality, integrity, and availability impact.
How can I assess whether an application is affected?
Check whether it was built with an affected SwarmKit version and grpc-go 1.39 or later. The issue specifically concerns the Cluster-API proxy's handling of forwarded TLS identity metadata.