CVE-2026-92542: Blind VXLAN injection into encrypted overlay networks from cluster peer
Blind VXLAN injection into encrypted overlay networks from cluster peer
Other sources
The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encrypted with the overlay-network IPsec parameters which meets the following criteria:
- UDP datagram - Destination port is the Swarm data-path port - Datagram starts with a VXLAN header for the VNI of an encrypted overlay network which any running container on the node is connected to
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 25.0.18-1 - Upgrade
Upgrade
alpine/dockerto a version that resolves this vulnerability.Fixed in 29.8.2-r0
Event History
Frequently Asked Questions
Which systems are exposed?
Exposure is limited to Linux Swarm nodes that have an encrypted overlay network and at least one running container connected to that overlay network. The issue concerns packets sent from the host network namespace.
What does an attacker need to exploit this?
The attacker needs local, low-privileged access sufficient to send packets from the host network namespace. The forged traffic must be a UDP datagram sent to the Swarm data-path port and begin with a VXLAN header for an encrypted overlay VNI used by a container on that node.
What is the expected security impact?
The CVSS vector indicates high impact to integrity and availability, with no confidentiality impact. Forged qualifying VXLAN traffic can be encrypted using the overlay network's IPsec parameters.