NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
MEDIUM severity

CVE-2021-41091 — moby

MEDIUMFix: moby/moby@f0ab919

CVE-2021-41091 is a medium-severity (CVSS 6.3) CWE-281 vulnerability in github.com/moby/moby. 2 public exploit or proof-of-concept references are indexed, so weaponization risk is real. A fix is available for github.com/moby/moby — see the affected versions and patch details below.

Moby (Docker Engine) Insufficiently restricted permissions on data directory

Also known asGHSA-3fwx-pjgw-3558GO-2024-2500
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
2 known
Exploitation data as of Oct 28, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
2.8%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs87th percentile — riskier than 87% of all scored CVEsHighest risk
1.83%3.37%4.91%6.45%5.6%2.8%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

2 pkgs affected
🐹github.com/moby/moby🐹github.com/docker/docker

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Impact

A bug was found in Moby (Docker Engine) where the data directory (typically /var/lib/docker) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files.

Patches

This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed.

Workarounds

Limit access to the host to trusted users. Limit access to host volumes to trusted containers.

Credits

The Moby project would like to thank Joan Bruguera for responsibly disclosing this issue in accordance with the Moby security policy.

For more information

If you have any questions or comments about this advisory:

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/moby/mobyall versions20.10.9go get github.com/moby/moby@v20.10.9
🐹Gogithub.com/docker/dockerall versions20.10.9go get github.com/docker/docker@v20.10.9

Affected Products

2 products · 3 configurations
OS
fedorafedoraproject
2 versions
3435
Application
mobymobyproject
< 20.10.9
range
Exploits & PoCs
2

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

Moby is an open-source project created by Docker to enable software cont…

github.comGithubMay 2023

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/moby/moby, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/moby/moby to 20.10.9 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2021-41091 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate

In the OpenShift Container Platform (OCP), the Migration Toolkit for Virtualization (MTV) and the Red Hat Advanced Cluster Management for Kubernetes (RHACM) some components bundle github.com/moby/moby. However, successful exploitation requires direct access to the cluster hosts, which is not allowed by default and is…

ProductFixed inAdvisory
Migration Toolkit for Virtualization 2.2migration-toolkit-virtualization/mtv-controller-rhel8:2.2.0-39RHEA-2021:5066

Frequently Asked Questions

## Impact A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could disc
O3 Security · Impact-Aware SCA

Is CVE-2021-41091 in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2021-41091: moby — Fixed in 20.10.9