Docker dependency CVE assessment (CVE-2026-42306, CVE-2026-41567, CVE-2026-41568, CVE-2026-33997, CVE-2026-34040)

[RichardSlater]

Docker Go module CVE assessment

Date created: 2026-05-19. Updated: 2026-08-19.

Summary

eirctl directly depends on github.com/docker/docker v28.5.2+incompatible. OSV currently reports five Docker/Moby CVEs against this legacy Go module. No patched version is recorded for this module. The module is already at its latest stable version.

The affected implementations are Docker daemon-side code. eirctl uses the Docker Go client to pull images; create, start, attach to, resize, inspect, stop, remove, and wait for containers; and stream logs. It does not embed or run a Docker daemon.

Dependency usage

The direct Docker module imports are limited to the container runner implementation:

• runner/executor_container.go
• runner/container_opts_unix.go
• runner/container_opts_windows.go
• runner/container_auth.go
• associated tests in runner/executor_container_test.go

The code does not call Docker archive or copy APIs (CopyToContainer, CopyFromContainer, ContainerArchive, or PutContainerArchive), implement a docker cp equivalent, install Docker plugins, or configure Docker AuthZ plugins.

CVE exposure assessment

CVE	Reported vulnerable behavior	eirctl usage assessment	Exploitability through current eirctl code
CVE-2026-42306	docker cp / archive copy race can redirect file operations to unintended host paths.	No archive or copy APIs are used.	Not exploitable through eirctl's current code paths.
CVE-2026-41567	Archive upload may resolve decompression helpers from a container-controlled path, allowing host code execution when compressed archives are uploaded to a malicious container.	eirctl does not upload archives into containers.	Not exploitable through eirctl's current code paths.
CVE-2026-41568	docker cp / archive copy race can write files outside the intended container boundary.	No archive or copy APIs are used.	Not exploitable through eirctl's current code paths.
CVE-2026-33997	Plugin privilege validation has an off-by-one error when installing a plugin that requests exactly one privilege.	eirctl does not install or manage Docker plugins.	Not exploitable through eirctl's current code paths.
CVE-2026-34040	An AuthZ plugin that relies on request-body inspection can be bypassed with an oversized request body.	eirctl does not configure or control Docker AuthZ plugins.	Not exploitable through eirctl's current code paths.

The first three findings concern Docker copy/archive operations. The latter two require Docker plugin or AuthZ-plugin configurations external to eirctl. The Docker engine that eirctl connects to may still be vulnerable when other users or tools meet these preconditions.

eirctl can run untrusted container images if a user chooses to do so, and can bind mount host paths into containers when enabled. That is a separate runner trust boundary: a malicious image can act on writable host paths explicitly mounted into it. It is not the affected archive/copy, plugin-install, or AuthZ-plugin behavior above.

Current risk position

The current risk is low for eirctl's own Docker integration, but not eliminated for the host Docker daemon. Residual risk is dependency- and environment-based:

1. Dependency scanners continue to report the module until upstream publishes a versioned fix or the client is migrated to a stable module with independent daemon code.
2. The host Docker daemon may still be vulnerable if other tools or users use archive/copy APIs, install plugins, or use susceptible AuthZ plugins.
3. Future eirctl archive/copy, plugin-management, or Docker-service functionality could create exposure and requires a security review before implementation.

Remediation plan

1. Track upstream Docker/Moby advisories and update github.com/docker/docker as soon as a patched module version is available.
2. Do not suppress the findings without this documented usage assessment.
3. Do not add archive/copy or plugin-management functionality while the dependency remains unpatched; require a dedicated security review if it becomes necessary.
4. Prefer trusted, pinned container images, especially where bind mounts are enabled.
5. Restrict host Docker daemon access to trusted users and automation identities; Docker socket access is privileged independently of these CVEs.
6. Keep connected Docker Engines updated to vendor-supported patched releases and re-run dependency scanning after each Docker module update.

Review triggers

Reassess this position if any of the following occur:

• github.com/docker/docker publishes a patched version for these CVEs;
• eirctl adds file copy, archive upload/download, image export/import, build-context upload, or plugin-management functionality;
• eirctl starts configuring or relying on Docker AuthZ plugins;
• the project starts exposing Docker API operations through a service boundary; or
• new advisory details identify affected APIs used by eirctl.