Docker Engine Vulnerability CVE-2026-34040 Allows Authorization Bypass

A high-severity vulnerability identified as CVE-2026-34040 has been disclosed in Docker Engine, allowing attackers to bypass authorization plugins under specific circumstances. This issue arises from an incomplete fix for an earlier critical vulnerability, CVE-2024-41110, within the same component.

What happened

Docker Engine is affected by a security flaw tracked as CVE-2026-34040, which can allow an attacker to circumvent authorization plugin controls. The vulnerability is related to a previous maximum-severity flaw, CVE-2024-41110, that was partially addressed but not fully fixed in the component.

Why it matters

Authorization bypass vulnerabilities can expose container environments to unauthorized access and potentially allow attackers to perform actions or access resources on the host system, undermining container security.

Key technical details

CVE-2026-34040 has a CVSS score of 8.8 and results from an incomplete remediation of CVE-2024-41110. It specifically affects the authorization plugins (AuthZ) mechanism in Docker Engine, enabling bypass under certain conditions.

Affected organizations/products

The vulnerability impacts Docker Engine installations utilizing authorization plugins. No additional affected products or organizations are specified.

Source attribution

https://thehackernews.com/2026/04/docker-cve-2026-34040-lets-attackers.html