CVE-2026-115538: Docker Engine overlay-network encryption rules are not restored after a firewalld reload

Published Nov 10, 2026

Updated

Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload or start signals over D-Bus. The missing rules cause outgoing VXLAN datagrams to bypass IPsec encryption and remove the protection against incoming cleartext VXLAN traffic. The condition is not logged by dockerd and persists until the encrypted network's last local endpoint is removed and another is added, or dockerd is restarted. Each further firewalld event repeats the condition.

Affected Software

0 affected components

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Operational
After firewalld deletes the rules, restart dockerd or remove the encrypted network's last local endpoint and then add another endpoint to restore the overlay-network IPsec rules.

Event History

Nov 10, 2026

CVE Published

via MITRE·07:58 PM

Data Sourced

via MITRE·07:58 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this condition?

Deployments using Docker Engine encrypted overlay networks are exposed when firewalld reloads or starts and deletes the applicable iptables rules. Networks without encrypted overlay traffic are not described as affected.

What must occur for traffic protection to fail?

A firewalld reload or start event must remove the overlay driver's iptables rules. After that event, outgoing VXLAN datagrams can bypass IPsec encryption and incoming cleartext VXLAN traffic is no longer blocked.

How can operators detect that an encrypted overlay network has entered this state?

dockerd does not log the condition. Operators must account for firewalld events and verify that the required iptables rules for encrypted overlay networks are present rather than relying on dockerd logs.

What can be done if restarting Docker Engine is not immediately possible?

Remove the encrypted network's last local endpoint and then add another local endpoint. This restores the condition described for the affected network; a dockerd restart is the other stated recovery option.

Does the issue resolve automatically after firewalld reloads?

No. The condition persists until the last local endpoint is removed and another is added, or dockerd is restarted. Each subsequent firewalld event can cause the condition again.

CVE-2026-115538: Docker Engine overlay-network encryption rules are not restored after a firewalld reload

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this condition?

What must occur for traffic protection to fail?

How can operators detect that an encrypted overlay network has entered this state?

What can be done if restarting Docker Engine is not immediately possible?

Does the issue resolve automatically after firewalld reloads?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this condition?

What must occur for traffic protection to fail?

How can operators detect that an encrypted overlay network has entered this state?

What can be done if restarting Docker Engine is not immediately possible?

Does the issue resolve automatically after firewalld reloads?