CVE-2026-80238: Critical severity Dell SCG 5.0 Appliance vulnerability
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privileges vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass. This vulnerability is considered critical because a low-privileged operator with SSH access to the SCG host can gain root-level access to the host without requiring a password by leveraging the exposed Docker socket. Additionally, an attacker who compromises a service running within the orchestrator container can access the same socket and escape the container boundary to obtain host-level control. Dell recommends that customers upgrade at the earliest opportunity.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dell SCG 5.0 Applianceto a version that resolves this vulnerability.Fixed in 5.36.00.16 - Upgrade
Upgrade
Dell SCG 5.0 Applicationto a version that resolves this vulnerability.Fixed in 5.36.00.00 - Compensating control
Restrict access to the exposed Docker socket (used by an orchestrator container) so that a compromised service in the orchestrator container cannot access it to escape the container boundary and obtain host-level control.
Event History
Frequently Asked Questions
Which deployments need to be upgraded?
Dell SCG 5.0 Appliance deployments before 5.36.00.16 and Dell SCG 5.0 Application deployments before 5.36.00.00 are affected. Upgrade to the applicable listed version or later at the earliest opportunity.
What access does an attacker need to gain host-level control?
A low-privileged operator with SSH access to the SCG host can leverage the exposed Docker socket to obtain root-level access without requiring a password. An attacker that compromises a service inside the orchestrator container can also use the same socket to escape the container and control the host.
Is this exploitable remotely without access to the SCG environment?
The available information describes exploitation by an attacker with local access, including an operator with SSH access or an attacker that has already compromised a service in the orchestrator container. It does not state that unauthenticated remote network access alone is sufficient.