AZL-113567: CVE-2026-115539 affecting package moby-engine 25.0.18-2
SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when built with grpc-go 1.39 or later. During a short window after a leader change, two proxy hops through managers with inconsistent views of the leader can allow an attacker possessing a valid worker node TLS certificate and private key to obtain a manager node certificate for the attacker's own key, escalating privileges from worker to manager. Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs possession of a valid worker node TLS certificate and its corresponding private key. Successful exploitation can escalate that worker identity to a manager identity.
When are deployments affected?
Applications are affected when they use an affected SwarmKit version built with grpc-go 1.39 or later. Exploitation also depends on a short period after a leader change in which two manager proxy hops have inconsistent views of the leader.
What conditions are required for the privilege escalation?
The attack requires two proxy hops through managers with inconsistent leader state shortly after a leader change. The proxy behavior can then cause the forwarded client TLS identity to be replaced with an intermediary manager identity, allowing issuance of a manager certificate for the attacker's key.