CVE-2026-92542

Executive Summary

CVE-2026-92542 is a security control bypass vulnerability in a Linux Swarm node's IPsec/VXLAN encryption firewall rule logic. The firewall rules responsible for marking VXLAN datagrams for encryption indiscriminately match both authentic, kernel-originated VXLAN traffic and forged VXLAN datagrams generated by any user process on the host network namespace. This allows a local attacker (or any process with the ability to send UDP traffic on the host) to inject forged VXLAN-encapsulated packets that will be automatically encrypted and forwarded using the overlay-network IPsec parameters, effectively granting unauthorized access to the encrypted overlay network. No public exploit or patch currently exists, and the vulnerability is unpatched as of this report.

Technical Analysis

CWE-290: Authentication Bypass by Spoofing. The vulnerability is fundamentally an insufficient verification of origin for VXLAN datagrams that are selected for IPsec encryption.

In a Docker Swarm deployment that uses encrypted overlay networks, VXLAN (Virtual Extensible LAN) encapsulated traffic is used to carry container-to-container overlay traffic between nodes. To secure this overlay, the Swarm data-path applies IPsec encryption to matching datagrams. To determine which packets need encryption, the node installs firewall rules (typically in the host's netfilter/iptables or nftables infrastructure) that match on:

• Protocol: UDP
• Destination port: the Swarm data-path port (the VXLAN UDP port used by Docker Swarm, conventionally 4789)
• Payload: a VXLAN header containing the VNI (VXLAN Network Identifier) of an encrypted overlay network that a running container on the node is connected to.

The flaw is that these firewall rules match only on packet characteristics — UDP protocol, destination port, and VXLAN header/VNI — without validating the source of the datagram (i.e., whether it actually originated from the kernel's VXLAN interface for a legitimate overlay network). Because any user process in the host network namespace can craft and send a UDP datagram with an arbitrary payload, that process can construct a datagram that:

1. Uses UDP as the transport protocol.
2. Is addressed to the Swarm data-path port.
3. Begins with a VXLAN header carrying the VNI of an encrypted overlay network that any running container on the node is connected to.

When such a forged datagram is emitted from the host network namespace, the local firewall rules classify it as overlay traffic requiring encryption. The packet is then encrypted using the overlay-network IPsec parameters (the same SA/policy associated with that encrypted overlay network) and forwarded to the destination. In effect, the sending process is granted an implicit encryption service that should only be available to legitimate kernel-originated overlay traffic.

Because a host-namespace-only attacker can force the node to encrypt arbitrary content under the overlay's IPsec policy, this constitutes a spoofing-based authentication bypass (CWE-290) of the implicit trust boundary between the host network namespace and the encrypted overlay.

The NVD description does not disclose the specific firewall back end (e.g., iptables vs. nftables), rule table/chain names, exact Swarm data-path port number, IPsec SA configuration mechanism, or the precise kernel version range. Those implementation details are not available from the supplied intelligence and should not be assumed.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (spoofing-based firewall rule bypass) and the mechanics described in the NVD entry.

1. Reconnaissance / target identification. An attacker who already holds a foothold as a local process or user in the host network namespace of a Linux Swarm node enumerates the node's encrypted overlay networks and their VNIs. (How VNIs are discovered is not specified in the available description.) The attacker also identifies the Swarm data-path port that the firewall rules match on. The presence of encrypted overlay networks on the node is the key precondition.

2. Triggering the flaw class. The attacker crafts a UDP datagram whose destination port is the Swarm data-path port and whose payload begins with a VXLAN header for the VNI of an encrypted overlay network that a running container on the node is connected to. The attacker then sends this datagram from the host network namespace. Because the firewall rules match indiscriminately on protocol, destination port, and VXLAN header/VNI, the forged packet is treated identically to a legitimate kernel-originated VXLAN datagram.

3. Payload / execution method. The forged datagram is encrypted with the overlay-network IPsec parameters and forwarded as if it were genuine overlay traffic. No exploitation primitive beyond the ability to send UDP from the host namespace is required. The attacker controls the payload carried inside the forged VXLAN encapsulation.

4. Post-exploitation impact. Successful exploitation allows the attacker to inject attacker-chosen content into the encrypted overlay data path under the overlay's IPsec protection, thereby bypassing the expectation that only legitimate container overlay traffic is encrypted and transmitted. This can enable access to overlay-network-reachable resources and manipulation of inter-node overlay traffic, potentially leading to lateral movement into encrypted overlay networks and, depending on overlay topology, to other Swarm nodes.

Note: Because no public PoC or exploit code exists, the exact success conditions (e.g., whether the node must have a specific kernel or Docker Engine version, or whether a routing change is additionally required to reach a remote peer) cannot be confirmed from the provided data.

Impact Assessment

• Confidentiality (C:H): The attacker can place attacker-controlled data into the encrypted overlay path, potentially reaching services in encrypted overlay networks that were assumed protected by the overlay's encryption and network boundary.
• Integrity (I:H): The attacker can cause forged datagrams to be accepted and forwarded under the overlay's IPsec parameters, allowing manipulation of overlay-destined data.
• Availability (A:N / not directly affected): The described mechanism is an authentication/origin spoofing issue; no direct denial-of-service consequence is specified.
• Scope (S:C): The vulnerability bypasses a trust boundary between the host network namespace and the encrypted overlay network, so impact crosses a security scope boundary.
• Attack Vector (AV:N): Although the sending process resides on the host, the resulting datagrams traverse and affect the network (overlay) path.
• Attack Complexity (AC:H): Exploitation requires knowledge of the target's encrypted overlay VNIs and the Swarm data-path port, and requires the ability to send on the host network namespace — non-trivial preconditions.
• Privileges Required (PR:L): The attacker needs a process on the host network namespace capable of sending UDP datagrams.
• User Interaction (UI:N): No user action is described as required.

Business impact: Organizations running Docker Swarm with encrypted overlay networks should treat the host network namespace as a higher-trust position than previously assumed. Any workload or process able to send UDP from the host namespace can bypass the implicit "only legitimate overlay traffic gets encrypted" assumption, undermining the confidentiality/integrity guarantees of encrypted overlay networks and enabling potential lateral movement across Swarm nodes.

Blast radius: Any Linux Swarm node that (a) uses encrypted overlay networks, (b) has the affected firewall rule logic, and (c) has a running container connected to an encrypted overlay network reachable by a host-namespace process.

Detection Guidance

Sigma Rule

title: Potential CVE-2026-92542 Forged VXLAN Datagram to Swarm Data-Path Port
id: 7b1c9f24-3e8a-4c19-9f6b-2026092542aa
status: experimental
description: Detects creation or use of raw/UDP sockets sending VXLAN-encapsulated datagrams to the Swarm data-path port from a host network namespace process, indicative of forged overlay datagram injection described in CVE-2026-92542.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92542
author: valtersit.com
date: 2026/09/25
tags:
  - attack.t1557
logsource:
  category: process_creation
  product: linux
detection:
  selection_tool:
    Image|endswith:
      - '/python3'
      - '/python'
      - '/socat'
      - '/nc'
      - '/ncat'
      - '/hping3'
      - '/scapy'
  selection_cmd:
    CommandLine|contains:
      - '4789'
      - 'vxlan'
      - 'sendto'
  condition: selection_tool and selection_cmd
falsepositives:
  - Legitimate network diagnostic tooling used by administrators
level: high

YARA Rule

rule CVE_2026_92542_VXLAN_Forged_Datagram
{
    meta:
        author = "valtersit.com"
        description = "Detects tooling/scripts that craft forged VXLAN datagrams targeted at the Swarm data-path UDP port (CVE-2026-92542)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92542"
        date = "2026-09-25"
        severity = "high"

    strings:
        $vxlan = "vxlan" ascii nocase
        $port4789 = "4789" ascii
        $swarm = "swarm" ascii nocase
        $overlay = "overlay" ascii nocase
        $vni = "vni" ascii nocase
        $sendto = "sendto" ascii
        $sock_dgram = "SOCK_DGRAM" ascii
        $ipsec = "ipsec" ascii nocase

    condition:
        uint32(0) != 0xfeedface and
        (
            (2 of ($vxlan, $port4789, $swarm) and 1 of ($sendto, $sock_dgram, $vni)) or
            ($port4789 and $vxlan and $ipsec)
        )
}

Suricata IDS Rule

alert udp any any -> any 4789 (msg:"CVE-2026-92542 Possible Forged VXLAN Datagram Targeting Swarm Encrypted Overlay VNI"; flow:to_server; content:"|08 00 00 00|"; offset:0; depth:4; byte_test:4,!,0,4,relative; threshold:type both, track by_src, count 4, seconds 60; reference:cve,2026-92542; classtype:attempted-admin; sid:2026092542; rev:1;)

Elastic Detection

sequence by host.id with maxspan=30s
  [process where event.type == "start" and process.name in ("python3", "python", "socat", "ncat", "hping3")]
  [network where event.action == "network_flow" and destination.port == 4789 and network.transport == "udp" and network.packets > 0]

Splunk SPL Query

index=network sourcetype=flow OR sourcetype=firewall
dest_port=4789 transport=udp
| stats count dc(src_ip) as src_count values(dest_ip) as dst values(payload_prefix) as payloads by src_ip, host
| where count > 5
| eval cve="CVE-2026-92542", note="UDP datagrams to Swarm data-path port; inspect for forged VXLAN headers with encrypted overlay VNI"
| table host src_ip dst count payloads cve note

Wazuh OSSEC Rule

<group name="linux,docker,swarm,">
  <rule id="100925" level="12">
    <decoded_as>json</decoded_as>
    <field name="dest_port">4789</field>
    <field name="proto">udp</field>
    <description>CVE-2026-92542 - UDP datagram to Swarm data-path port, possible forged VXLAN overlay injection</description>
    <mitre>
      <id>T1557</id>
    </mitre>
    <group>cve_2026_92542,</group>
  </rule>
  <rule id="100926" level="13">
    <if_sid>100925</if_sid>
    <field name="payload_prefix">08 00 00 00</field>
    <description>CVE-2026-92542 - Detected VXLAN header on UDP/4789 traffic; verify VNI belongs to an encrypted overlay network</description>
    <mitre>
      <id>T1557</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Restrict the ability of workloads and users to operate in the host network namespace, and limit which processes can send UDP traffic with arbitrary payloads to the Swarm data-path port.
   • Apply host-based egress filtering to prevent host-namespace processes other than the container runtime/kernel overlay components from sending UDP datagrams to the Swarm data-path port.
   • Monitor and alert on UDP traffic to the Swarm data-path port that carries a VXLAN header for an encrypted overlay VNI but does not originate from the expected kernel VXLAN interface.
   • If encrypted overlay networks are not strictly required, consider not enabling them until a fix is available, to reduce exposure surface.

2. Patch / upgrade steps.

   • No vendor patch is currently available. Track the upstream Docker Engine / Linux kernel advisories for a fix that adds source validation to the encryption firewall rules (for example, ensuring only datagrams originating from the kernel's VXLAN interface are matched for encryption).
   • When a patched release is published, upgrade Docker Engine and the associated kernel/netfilter rule generation logic on all Swarm nodes, then re-verify the encryption firewall rule set.

3. Long-term hardening.

   • Enforce the principle of least privilege for host network namespace access and audit any workload that requires it.
   • Adopt zero-trust validation for overlay traffic selection (source-interface scoping rather than payload pattern matching).
   • Continuously monitor Swarm node firewall rules to ensure only kernel-originated VXLAN traffic is eligible for IPsec encryption.
   • Segment Swarm management and overlay traffic and apply network monitoring for anomalous datagrams to the Swarm data-path port.

References

1. NVD — CVE-2026-92542: https://nvd.nist.gov/vuln/detail/CVE-2026-92542
2. CWE-290 — Authentication Bypass by Spoofing: https://cwe.mitre.org/data/definitions/290.html
3. MITRE ATT&CK T1557 — Adversary-in-the-Middle: https://attack.mitre.org/techniques/T1557/
4. Docker documentation — Overlay networks and encrypted overlay networks: https://docs.docker.com/network/overlay/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-92542 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence is available at this time; EPSS is 0.00066 (0.0% percentile) and no public PoC, Nuclei template, or exploit code has been observed.