ZDI-CAN-31929: ZDI-26-959: Docker Agent read_skill Missing Authorization Remote Code Execution Vulnerability

Published Nov 13, 2026

Updated

This vulnerability allows local attackers to execute arbitrary code on affected installations of Docker Agent. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.

Affected Software

0 affected components

Event History

Nov 13, 2026

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

Who is realistically exposed to exploitation?

Affected Docker Agent installations are exposed to local attackers. Exploitation also requires a user on the target system to visit a malicious page or open a malicious file.

What access and conditions does an attacker need?

The attacker must be able to act locally on the affected installation and must induce user interaction with malicious web content or a malicious file. The provided information does not describe a network-only exploitation path.

What is the potential impact if exploitation succeeds?

A successful exploit allows arbitrary code execution on the affected Docker Agent installation. The advisory assigns the issue a CVSS score of 7.8.

ZDI-CAN-31929: ZDI-26-959: Docker Agent read_skill Missing Authorization Remote Code Execution Vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is realistically exposed to exploitation?

What access and conditions does an attacker need?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to exploitation?

What access and conditions does an attacker need?

What is the potential impact if exploitation succeeds?