OESA-2026-4657: docker security update

Q: What conditions are required for exploitation?

An attacker needs to control or influence DNS answers for a registry hostname and cause the hostname to resolve to both a loopback address and a non-loopback attacker-controlled address. A user or process must then connect to that registry hostname.

Q: Are default Docker settings affected?

Yes. Docker injects 127.0.0.0/8 and ::1/128 into its insecure registry CIDR list by default, so a hostname with any loopback DNS answer can be classified as insecure.

Q: What is the security impact of a successful exploit?

Docker can disable certificate verification and allow HTTP fallback for the registry connection. This can allow an attacker-controlled non-loopback endpoint to be used after the hostname is classified as insecure.

Published Oct 29, 2026

Updated

Docker is an open source project to build, ship and run any application as a lightweight container. Security Fix(es):

Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Because the transport re-dials the hostname rather than the CIDR-matching address, a DNS answer set of one loopback IP plus a non-loopback attacker IP disables certificate verification and enables HTTP fallback for the registry connection.(CVE-2026-92543)

Affected Software

1 affected componentFixes available

openeuler/docker<engine-18.09.0-355.oe2203sp4

engine-18.09.0-355.oe2203sp4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/docker to a version that resolves this vulnerability.
Fixed in engine-18.09.0-355.oe2203sp4

Event History

Oct 29, 2026

Advisory Published

via OSV·09:04 AM

Data Sourced

via OSV·09:04 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-92543

Frequently Asked Questions

What conditions are required for exploitation?

An attacker needs to control or influence DNS answers for a registry hostname and cause the hostname to resolve to both a loopback address and a non-loopback attacker-controlled address. A user or process must then connect to that registry hostname.

Are default Docker settings affected?

Yes. Docker injects 127.0.0.0/8 and ::1/128 into its insecure registry CIDR list by default, so a hostname with any loopback DNS answer can be classified as insecure.

What is the security impact of a successful exploit?

Docker can disable certificate verification and allow HTTP fallback for the registry connection. This can allow an attacker-controlled non-loopback endpoint to be used after the hostname is classified as insecure.

OESA-2026-4657: docker security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions are required for exploitation?

Are default Docker settings affected?

What is the security impact of a successful exploit?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

Are default Docker settings affected?

What is the security impact of a successful exploit?