CVE-2025-54410
LowCVSS 3.3Summary
Moby (Docker Engine) releases before 28.0.0 are affected by a firewalld vulnerability. When firewalld reloads, Docker fails to re-create iptables rules isolating bridge networks, allowing any container to access all ports on any other container across different bridge networks on the same host. Only containers in --internal networks remain protected.
Risk Assessment
Broken network segmentation between containers creates significant risk in multi-tenant environments by enabling unauthorized cross-container access.
Recommendation
Update Moby/Docker to a version containing the fix, or apply workarounds: after reloading firewalld, restart the Docker daemon, re-create bridge networks, or use rootless mode.
Other vulnerabilities in Moby
See all- CVE-2026-34040High
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.
- CVE-2026-41567High
Moby (Docker Engine) before versions 29.5.1 and v2.0.0-beta.14 has a vulnerability where the daemon uses decompression binaries from the container's filesystem when extracting archives. A malicious image can replace these binaries, leading to arbitrary code execution with full daemon privileges.
- CVE-2026-33997Medium
Moby (Docker) before version 29.3.1 has a vulnerability that allows bypassing plugin privilege validation during installation. The daemon may accept a privilege set different from the user-approved one, and for single-privilege plugins no comparison is performed.
Original NVD description (English source)
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. A firewalld vulnerability affects Moby releases before 28.0.0. When firewalld reloads, Docker fails to re-create iptables rules that isolate bridge networks, allowing any container to access all ports on any other container across different bridge networks on the same host. This breaks network segmentation between containers that should be isolated, creating significant risk in multi-tenant environments. Only containers in --internal networks remain protected. Workarounds include reloading firewalld and either restarting the docker daemon, re-creating bridge networks, or using rootless mode. Maintainers anticipate a fix for this issue in version 25.0.13.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS