OESA-2026-4719: docker security update
Docker is an open source project to build, ship and run any application as a lightweight container. Security Fix(es):
Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Because the transport re-dials the hostname rather than the CIDR-matching address, a DNS answer set of one loopback IP plus a non-loopback attacker IP disables certificate verification and enables HTTP fallback for the registry connection.(CVE-2026-92543)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/dockerto a version that resolves this vulnerability.Fixed in engine-18.09.0-358.oe2403sp1
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker needs to cause a registry hostname to resolve to both a loopback address, such as an address in 127.0.0.0/8 or ::1/128, and an attacker-controlled non-loopback address. The client must then connect to that hostname, and user interaction is required according to the provided severity vector.
Are default Docker settings affected?
Yes. The affected logic adds 127.0.0.0/8 and ::1/128 to the insecure registry CIDR list by default. A hostname with any matching loopback DNS result can therefore be treated as insecure even when another DNS result directs the subsequent connection elsewhere.
What is the impact of a successful attack?
Certificate verification can be disabled for the registry connection, and Docker can fall back to HTTP. This can allow an attacker-controlled registry endpoint to affect the confidentiality and integrity of the connection; the supplied vector indicates no availability impact.
How can I determine whether a registry hostname is exposed to this condition?
Check whether registry hostnames used by Docker resolve to a mixed DNS answer set containing both a loopback address in 127.0.0.0/8 or ::1/128 and a non-loopback address. The issue occurs when Docker treats the hostname as insecure based on the loopback result but re-dials the hostname and reaches the non-loopback address.