high CVSS 7.2 EPSS 0.17%

CVE-2026-27466·Docker vulnerability

BigBlueButton is an open-source virtual classroom. In versions 3.0.21 and below, the official documentation for "Server Customization" on Support for ClamAV as presentation file scanner contains instructions that leave a BBB server vulnerable for Denial of Service. The flawed command exposes both ports (3310 and 7357) to the internet. A remote attacker can use this to send complex or large documents to clamd and waste server resources, or shutdown the clamd process. The clamd documentation explicitly warns about exposing this port. Enabling ufw (ubuntu firewall) during install does not help, because Docker routes container traffic through the nat table, which is not managed or restricted by ufw. Rules installed by ufw in the filter table have no effect on docker traffic. In addition, the provided example also mounts /var/bigbluebutton with write permissions into the container, which should not be required. Future vulnerabilities in clamd may allow attackers to manipulate files in that folder. Users are unaffected unless they have opted in to follow the extra instructions from BigBlueButton's documentation. This issue has been fixed in version 3.0.22.

Severity
high
Software
Docker
Fixed in
3.0.22
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.17% — higher than 38% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-27466 scores 7.2 on CVSS, so a successful attack would be serious — but at 0.17%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

Until: 3.0.22

Fixed in: 3.0.22

How to fix this CVE

Upgrade Docker to version 3.0.22 or later to address this vulnerability. If you have followed BigBlueButton's ClamAV integration documentation, immediately review your Docker networking configuration to restrict access to ports 3310 and 7357, and remove unnecessary write permissions from mounted volumes. Apply firewall rules at the host level to prevent external access to ClamAV container ports.

sudo dnf upgrade docker-ce

Defensia detects this vulnerability

How to check if you are affected

  1. Step 1: Check Docker version with 'docker --version' and compare against 3.0.22
  2. Step 2: List running containers with 'docker ps' and inspect ClamAV containers using 'docker port <container_id>' to check if ports 3310 or 7357 are exposed to 0.0.0.0
  3. Step 3: Review Docker container configurations with 'docker inspect <container_id>' and verify volume mounts do not include /var/bigbluebutton with write permissions
  4. Step 4: Confirm the fix by verifying upgraded Docker version and re-inspecting container port bindings to ensure ClamAV ports are not publicly accessible

FAQ

What is CVE-2026-27466?

This vulnerability affects BigBlueButton servers running version 3.0.21 and earlier that have implemented ClamAV antivirus scanning following official documentation. The flawed configuration exposes ClamAV daemon ports to the internet, allowing remote attackers to trigger denial-of-service conditions by sending malicious or oversized documents to exhaust server resources.

Is CVE-2026-27466 being actively exploited?

No, there is no evidence of active exploitation or publicly available exploits for this vulnerability at this time.

What versions of Docker are affected by CVE-2026-27466?

BigBlueButton versions up to and including 3.0.21 are vulnerable. The vulnerability is patched in version 3.0.22 and later.

How do I check if my server is vulnerable to CVE-2026-27466?

Run 'docker ps' to list containers, then execute 'docker port <clamd_container_id>' to check if ports 3310 or 7357 are bound to 0.0.0.0. If they are, your system is vulnerable. Additionally, check your docker-compose or container run commands for mounted volumes with /var/bigbluebutton write access.

Does Defensia detect CVE-2026-27466?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Docker is installed on a monitored server, CVE-2026-27466 will appear in your dashboard with remediation steps.

Related Docker CVEs

CVE-2026-57572CVSS 10Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted request-supplied browser_config.extra_args, which flowed into Chromium's launch arguments. An attacker could inject Chromium switches that replace a child-process launch command together with --no-zygote, causing Chromium to fork or exec an attacker-controlled command as the container's runtime user. The Docker API is unauthenticated by default, so a single request yields arbitrary command execution. This issue is fixed in version 0.9.0.
CVE-2026-33587CVSS 10Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on the docker container via Server-Side Template Injection (SSTI) for user-created transformations.
CVE-2026-44329CVSS 10free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without OAuth2/bearer-token authorization middleware. A network attacker who can reach SMF on the SBI can hit UPI endpoints with no Authorization header at all, and the requests reach the SMF business handlers. In the running Docker lab this was directly demonstrated for read (GET /upi/v1/upNodesLinks), write (POST /upi/v1/upNodesLinks with attacker-controlled UP-node and link payload), and delete (DELETE /upi/v1/upNodesLinks/{nodeID}) operations. This vulnerability is fixed in 4.2.2.
CVE-2026-53576CVSS 10Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresses its resources by URL path segments that the caller chooses (/api/v1/{tenant}/flows/{namespace}, /api/v1/{tenant}/executions/{namespace}/{id}, /api/v1/{tenant}/namespaces/{namespace}/kv/{key}). An anonymous caller picks the literal configs as the final segment, and the request bypasses Basic-Auth entirely. Because the bypass reaches the flow-create and execution-trigger routes, an unauthenticated caller creates a flow containing a Shell or Process task and runs it. The task executes as root inside the kestra container. The official docker-compose.yml mounts /var/run/docker.sock, so root in the container reaches the host Docker daemon. This vulnerability is fixed in 1.0.45 and 1.3.21.
CVE-2026-26216CVSS 10Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands. Successful exploitation allows full server compromise, including arbitrary command execution, file read and write access, sensitive data exfiltration, and lateral movement within internal networks.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-27466. Free for 1 server.

Get started free