CVE-2026-33997

HighCVSS 8.1/10Last modified Sep 9, 2026

Description

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-193CWE-266

Affected software

VendorProductVersions
mobymoby< 29.3.1
Red HatMulticluster Global Hub 1.4.5—
Red HatMulticluster Global Hub 1.6.5—
Red HatRed Hat multicluster global hub 1.5.3—
Red HatMulticluster Engine for Kubernetes—
Red HatMulticluster Engine for Kubernetes—
Red HatOpenShift Service Mesh 2—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Virtualization 4—

References

Timeline

Published
Mar 31, 2026
Last modified
Sep 9, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-339997.8A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an CVE-2026-34009.8A security flaw has been discovered in Tenda AC15 up to 15.13.07.13. Affected by this issue is some unknown functionality of the file /goforCVE-2026-340009.1A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckCVE-2026-340017.8A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within thCVE-2026-340029.1A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handlCVE-2026-340037.8A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X CVE-2026-340058.8In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters CVE-2026-340069.3A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability cCVE-2026-340076.9An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackCVE-2026-340088.5An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gainCVE-2026-340098.4An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an adminiCVE-2026-34016.6A weakness has been identified in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown part. This manipu