ZDF
Sign inSign up

Docker · week of 12 Oct 2026

Docker security note

Records on this stack that changed between 12 Oct 2026 and the following Monday. Versions come from the stored ranges. A quiet week is not proof the stack is clear.

What changed

  • CVE-2025-64443 — Open the advisory

    MCP Gateway allows easy and secure running and deployment of MCP servers.

    Affected: <= 0.27.0

  • CVE-2026-95837 — Check if you run it

    containerd CRI plugin: Checkpoint restore bypasses destination security context

    Affected: 2.1.0 → 2.2.7, 2.3.0 → 2.3.4, >= 2.1.0, < 2.2.7

  • CVE-2026-95838 — Check if you run it

    containerd: Unpack DoS via repeated opaque whiteouts

    Affected: < 1.7.35, <1.7.35, < 2.0.12, >= 2.2.0

  • SUSE-SU-2026:24136-1 — Open the advisory

    Security update for containerd

    Affected: 0 → 1.7.29-159998.1.1

  • SUSE-SU-2026:4671-1 — Open the advisory

    Security update for containerd

    Affected: 0 → 1.7.29-16.116.1

What we still do not know

  • CVE-2026-42596 — Patch now

    Gotenberg is a Docker-powered stateless API for PDF files.

    No version range is stored, so an installed version cannot be checked.

  • CVE-2026-73802 — Check if you run it

    Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled.

    No version range is stored, so an installed version cannot be checked.

  • CVE-2026-105039 — Check if you run it

    EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs.

    No version range is stored, so an installed version cannot be checked.

  • CVE-2026-47218 — Check if you run it

    runwasi facilitates running Wasm and WASI workloads managed by containerd.

    No version range is stored, so an installed version cannot be checked.

  • CVE-2025-13743 — Check if you run it

    Docker Desktop diagnostics bundles were found to include expired Hub PATs in log output due to error object serialization.

    No version range is stored, so an installed version cannot be checked.

  • CVE-2026-86002 — Check if you run it

    Dokku is a docker-powered platform as a service.

    No version range is stored, so an installed version cannot be checked.

Share this note

Docker security note, week of 12 Oct 2026: 5 records have a version a customer can check, and 6 still do not. https://zerodayfindings.com/technologies/docker/notes/2026-W42

Docker security note, week of 12 Oct 2026 · ZeroDay Findings