CVE-2026-33997

Name	CVE-2026-33997
Description	Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
docker.io (PTS)	bullseye	20.10.5+dfsg1-1+deb11u2	vulnerable
	bullseye (security)	20.10.5+dfsg1-1+deb11u4	vulnerable
	bookworm	20.10.24+dfsg1-1+deb12u1	vulnerable
	trixie	26.1.5+dfsg1-9	vulnerable
	forky, sid	28.5.2+dfsg3-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
docker.io	source	(unstable)	(unfixed)

Notes

[trixie] - docker.io <no-dsa> (Minor issue)
[bookworm] - docker.io <no-dsa> (Minor issue)
https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9
https://github.com/moby/moby/commit/0afb41ce194ca8f83436b332c18105279923ba14 (28.x)