CVE-2026-92543: Docker Engine insecure-registry fallback via malicious DNS responses
Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Because the transport re-dials the hostname rather than the CIDR-matching address, a DNS answer set of one loopback IP plus a non-loopback attacker IP disables certificate verification and enables HTTP fallback for the registry connection.
Other sources
Docker Engine insecure-registry fallback via malicious DNS responses
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 25.0.7-6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.27.0-16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.14.0-19 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.12.15-15
Event History
Frequently Asked Questions
Are Docker Engine installations affected without explicitly configuring an insecure registry?
Yes. Docker Engine adds 127.0.0.0/8 and ::1/128 to its insecure CIDR list by default, so an explicit insecure-registry configuration is not required for the described condition.
What DNS response is needed to trigger the insecure-registry behavior?
The registry hostname must resolve to multiple addresses, including at least one loopback address that matches the default insecure CIDRs and a non-loopback attacker-controlled address. The any-match check classifies the hostname as insecure based on the loopback result, while the later connection can be made to the non-loopback address.
What is the security impact once the hostname is classified as insecure?
Certificate verification can be disabled and the registry connection can fall back to HTTP. This can compromise the confidentiality and integrity of registry traffic.