UBUNTU-CVE-2026-115539: Medium severity ubuntu/docker.io vulnerability
SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when built with grpc-go 1.39 or later. During a short window after a leader change, two proxy hops through managers with inconsistent views of the leader can allow an attacker possessing a valid worker node TLS certificate and private key to obtain a manager node certificate for the attacker's own key, escalating privileges from worker to manager. Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid worker node TLS certificate and its corresponding private key. The described impact is privilege escalation from a worker identity to a manager identity.
What conditions are required for exploitation?
The application must use an affected SwarmKit version built with grpc-go 1.39 or later. Exploitation also requires a short period after a leader change in which two manager proxy hops have inconsistent views of the leader.
Are all Docker deployments affected?
The issue applies to applications built with an affected SwarmKit version and grpc-go 1.39 or later. The provided information does not establish whether a default Docker configuration is affected.
What is the resulting impact if exploitation succeeds?
The attacker can obtain a manager node certificate for a key they control. This elevates the attacker from worker-node privileges to manager-node privileges.