CVE-2026-33997

Executive Summary

CVE-2026-33997 is a privilege validation bypass vulnerability in Moby (Docker Engine) affecting the docker plugin install command. Due to an error in the daemon's privilege comparison logic, a malicious plugin can request a set of privileges that differs from the one approved by the user, effectively bypassing user consent. In cases where a plugin requests exactly one privilege, no comparison is performed at all, allowing the plugin to gain unauthorized capabilities. The vulnerability has a CVSS score of 6.8 (Medium) and is patched in version 29.3.1. No public proof-of-concept or exploit code is currently available.

Supply Chain & Package Security

This vulnerability is specific to the Docker ecosystem and does not directly affect NPM, PyPI, Go, or Ruby packages. However, it impacts the container supply chain by allowing untrusted plugins to escalate privileges during installation, potentially compromising the host or other containers.

CVSS Breakdown & Threat Level

• CVSS Score: 6.8 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: Local (requires user to install a plugin)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (user must approve the plugin installation)
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The threat level is elevated due to the potential for complete host compromise if a malicious plugin is installed. The requirement for user interaction slightly reduces the risk, but the low attack complexity makes it a viable target for social engineering.

Deep Dive & Mechanics

The vulnerability resides in the Docker daemon's privilege validation logic during the docker plugin install workflow. When a user installs a plugin, the daemon presents a set of requested privileges to the user for approval. The flaw occurs in two scenarios:

1. Single Privilege Request: When a plugin requests exactly one privilege, the daemon performs no comparison between the requested and approved privileges. This means any single privilege (e.g., CAP_SYS_ADMIN) is automatically accepted without validation.

2. Multiple Privilege Request: When a plugin requests multiple privileges, the comparison logic is flawed. The daemon may incorrectly accept a privilege set that differs from the one approved by the user, due to improper handling of privilege lists or ordering.

The root cause is a missing or incorrect comparison function in the daemon's plugin installation handler. The fix in version 29.3.1 ensures that the privilege set presented to the user is strictly compared against the set actually granted to the plugin.

Vulnerable vs. Patched Code

Vulnerable Code (Moby < 29.3.1):

// In daemon/plugin.go or similar
func (pm *pluginManager) installPlugin(ctx context.Context, name string, opts ...InstallOpt) error {
    // ...
    privileges := pm.getPrivileges(plugin)
    if len(privileges) == 1 {
        // BUG: No comparison performed for single privilege
        return pm.install(plugin, privileges)
    }
    // Flawed comparison for multiple privileges
    if !pm.comparePrivileges(approvedPrivileges, privileges) {
        return fmt.Errorf("privilege mismatch")
    }
    // ...
}

Patched Code (Moby >= 29.3.1):

// In daemon/plugin.go
func (pm *pluginManager) installPlugin(ctx context.Context, name string, opts ...InstallOpt) error {
    // ...
    privileges := pm.getPrivileges(plugin)
    // Fixed: Always compare privileges, even for single privilege
    if !pm.comparePrivileges(approvedPrivileges, privileges) {
        return fmt.Errorf("privilege mismatch")
    }
    // ...
}

The patch ensures that the comparePrivileges function is always called, regardless of the number of privileges requested.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Docker Engine version < 29.3.1
• Ability to create a malicious Docker plugin

Exploitation Steps:

1. Create a malicious plugin that requests a single high-privilege capability (e.g., CAP_SYS_ADMIN):

   mkdir malicious-plugin
   cd malicious-plugin
   cat > config.json << 'EOF'
   {
     "Name": "malicious-plugin",
     "Version": "1.0.0",
     "Privileges": [
       {
         "Name": "CAP_SYS_ADMIN",
         "Description": "System administration"
       }
     ]
   }
   EOF
   cat > rootfs.tar << 'EOF'
   # Place a malicious binary or script here
   EOF
   docker plugin create malicious-plugin .
   

2. Distribute the plugin via a registry or direct file transfer.

3. Victim installs the plugin (user interaction required):

   docker plugin install malicious-plugin
   

   The daemon will present the privilege request, but due to the bug, no comparison is performed, and the plugin is installed with CAP_SYS_ADMIN.

4. Activate the plugin to execute malicious code with elevated privileges:

   docker plugin enable malicious-plugin
   

Expected Outcome: The attacker gains CAP_SYS_ADMIN capabilities on the host, allowing container escape or host compromise.

Blue Team

Detection Steps:

1. Monitor plugin installation events in Docker daemon logs:

   journalctl -u docker.service | grep "plugin install"
   

2. Audit installed plugins for unexpected privileges:

   docker plugin ls
   docker plugin inspect <plugin-name> --format '{{.Privileges}}'
   

3. Check Docker version to identify vulnerable installations:

   docker version --format '{{.Server.Version}}'
   

4. Implement runtime monitoring for plugin-related syscalls (e.g., capset, capget).

Indicators of Compromise (IOCs)

• File Indicators:

  • Suspicious plugin directories under /var/lib/docker/plugins/
  • Unexpected plugin configuration files with high-privilege capabilities

• Network Indicators:

  • Outbound connections from plugin processes to unknown IPs
  • Plugin registry downloads from untrusted sources

• Process Indicators:

  • Docker plugin processes running with unexpected capabilities
  • Child processes spawned by plugin binaries with elevated privileges

• Log Indicators:

  • Docker daemon logs showing plugin installation without privilege comparison
  • Audit logs showing CAP_SYS_ADMIN or other high-privilege capabilities granted to plugin processes

Detection Engineering

YARA Rule

rule CVE_2026_33997_Docker_Plugin_Privilege_Bypass {
    meta:
        description = "Detects Docker plugin config files with single privilege request (CVE-2026-33997)"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-33997"
        hash = "unknown"
    strings:
        $json_start = /"Privileges"\s*:\s*\[/
        $single_priv = /"Privileges"\s*:\s*\[\s*\{/
        $cap_string = /"Name"\s*:\s*"CAP_/
    condition:
        $json_start and #single_priv == 1 and #cap_string >= 1
}

Sigma Rule

title: Docker Plugin Installation with Single Privilege
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects Docker plugin installation where only one privilege is requested, indicating potential CVE-2026-33997 exploitation
author: Valters IT
date: 2025-04-10
references:
    - CVE-2026-33997
logsource:
    product: linux
    service: docker
detection:
    selection:
        EventID: 1000  # Docker daemon event
        Message|contains: "plugin install"
        Privileges|count: 1
    condition: selection
falsepositives:
    - Legitimate plugins that require only one privilege
level: medium

Suricata Rule

alert tcp any any -> any 2375 (msg:"CVE-2026-33997 Docker Plugin Install with Single Privilege"; flow:to_server; content:"plugin install"; content:"Privileges"; pcre:"/\"Privileges\"\s*:\s*\[\s*\{/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Docker Engine to version 29.3.1 or later:

   sudo apt-get update && sudo apt-get install docker-ce=29.3.1
   

   Or for other distributions, follow official Docker upgrade instructions.

2. Audit all installed plugins and remove any that are suspicious or unnecessary:

   docker plugin rm <plugin-name>
   

3. Restrict plugin installation to trusted registries only:

   # In /etc/docker/daemon.json
   {
     "registry-mirrors": ["https://trusted-registry.example.com"]
   }
   

Long-Term Mitigations:

• Implement a plugin approval workflow requiring manual review of requested privileges.
• Use Docker Content Trust to verify plugin signatures.
• Monitor Docker daemon logs for unusual plugin installation events.
• Apply the principle of least privilege to all container and plugin deployments.

Workarounds (if patching is not immediately possible):

• Disable plugin installation entirely by setting "experimental": false in daemon.json.
• Use AppArmor or SELinux profiles to restrict plugin capabilities.
• Implement network segmentation to prevent plugin downloads from untrusted sources.

Report generated by Valters IT DevSecOps & CTI Division

{/* [Security Hash: AD18D905A05DBC1BCBDCBD29] */}