Docker CVE-2026-92543

Exploitation requires the attacker to occupy a man-in-the-middle position on the network path (reflected by AT:P, attack requirement present) and requires the victim to initiate a TLS connection with the vulnerable Docker/moby client (UI:P, passive user interaction). The improper certificate validation (CWE-295) means a forged or invalid certificate is accepted, so the attacker must be able to intercept and respond on the TLS channel. Limiting factors: high attack complexity (AC:H), dependence on achieving a privileged network position, and the need for a user/client to establish the affected connection - exploitation is not possible by simply reaching the host remotely. Affected: Alpine Linux docker package before 29.8.2-r0.

CVSS 4.0 rates this 7.6 (High), driven by high confidentiality and integrity impact (VC:H/VI:H) over a network vector with no privileges required (AV:N/PR:N). However, the real-world exploitation signals temper this: AC:H (high attack complexity), AT:P (a specific attack requirement/precondition must be present), and UI:P (passive user interaction) all indicate exploitation is non-trivial and situational rather than trivially remote. This aligns with CWE-295 (Improper Certificate Validation), which typically requires the attacker to hold a man-in-the-middle position on the network path. No EPSS score, KEV listing, or POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a genuinely impactful flaw in a very widely deployed product, but the combination of required MITM positioning, high complexity, and user interaction makes it a patch-in-normal-cycle item rather than an emergency, absent any exploitation signal. Note the input provides only a CVSS 4.0 vector (no 3.1), and the description ('docker fixed in 29.8.2-r0') contains no technical detail - the CWE and advisory reference, not the description, drive this interpretation; verify specifics against moby advisory GHSA-7cfq-22r6-qp73.

An attacker positioned on the network path between a Docker/moby client and a remote TLS endpoint (e.g. a registry or daemon connection) exploits improper certificate validation to present a fraudulent certificate that the client accepts. This lets the attacker intercept or tamper with the TLS session, disclosing sensitive data (such as credentials or image content) and potentially altering transferred data. No public exploit code is identified at time of analysis, and success requires both the MITM position and the victim initiating a connection.