CVE-2026-92543
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
Vulnerability in Docker Engine regarding incorrect classification of a registry as insecure. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default, and isCIDRMatch returns true if any host address matches. An attacker can use a DNS answer with a loopback IP and an attacker IP to disable certificate verification and enable HTTP fallback.
Risk Assessment
An attacker can intercept registry traffic, impersonate the registry, and inject malicious container images, potentially leading to container environment integrity compromise and malicious code execution in the organization.
Recommendation
Update Docker Engine to a patched version. Additionally, configure registries as secure (HTTPS) and avoid using insecure registries in production environments.
Other vulnerabilities in Docker Engine
See all- CVE-2025-54388Medium
In Docker Engine versions 28.2.0 through 28.3.2, reloading the firewalld service removes all iptables rules including those created by Docker. Versions before 28.3.3 fail to recreate the rules blocking external access to containers, so containers with ports published to localhost become accessible from remote machines with routing to the Docker bridge. This is fixed in version 28.3.3.
- CVE-2016-8867High
Docker Engine version 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.
- CVE-2015-3630High
Docker Engine before version 1.6.1 uses weak permissions for several system directories, allowing local users to modify the host and obtain sensitive information.
Original NVD description (English source)
Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Because the transport re-dials the hostname rather than the CIDR-matching address, a DNS answer set of one loopback IP plus a non-loopback attacker IP disables certificate verification and enables HTTP fallback for the registry connection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS