CVE-2026-42596·Docker vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at <0.1% — higher than 24% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-42596 scores 9.4 on CVSS, so a successful attack would be serious — but at <0.1%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

How to fix this CVE

Update Docker to version 8.31.0 or later to patch the Gotenberg URL filter bypass vulnerability in the downloadFrom and webhook features. The vulnerability allows attackers to bypass the regex-based deny-list by using alternative IPv6 loopback notation (e.g., [::ffff:127.0.0.1]) to reach internal services. Apply this update immediately to prevent unauthorized outbound requests to private HTTP services.

sudo dnf update docker-ce docker-ce-cli docker-buildx-plugin docker-compose-plugin

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET.*/(downloadFrom|webhook).*HTTP.*(?:::ffff:|::1|localhost|127\.0\.0\.|169\.254\.|10\.0\.0\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement strict URL validation on all incoming requests to Gotenberg endpoints (downloadFrom, webhook). Enforce a whitelist of allowed destination domains and block requests containing IPv6 loopback notation ([::ffff:127.0.0.1], [::1]), private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and link-local addresses (169.254.0.0/16). Apply case-sensitive matching to ensure bypass attempts with mixed-case schemes are rejected.

How to check if you are affected

1. Check installed Docker version: docker --version
2. Verify Gotenberg component version: docker inspect $(docker ps -q --filter 'ancestor=gotenberg') 2>/dev/null | grep -i version || echo 'Gotenberg container not running'
3. Search Docker daemon logs for suspicious downloadFrom or webhook requests: sudo journalctl -u docker --since '24 hours ago' | grep -E '(downloadFrom|webhook|127\.0\.0\.1|::ffff)' | head -20
4. Confirm patch installation after update: docker --version | grep -E '20\.(10|11)|8\.31' && echo 'Vulnerable version detected' || echo 'Update completed'

Indicators of compromise

• GET/POST requests with [::ffff:127.0.0.1] in URL parameters
• downloadFrom or webhook requests targeting internal IP ranges
• URL patterns with mixed-case protocol schemes (e.g., hTTp://, HtTp://)
• Outbound HTTP connections from Docker daemon to RFC1918 private addresses

FAQ

Related Docker CVEs

References

• https://github.com/gotenberg/gotenberg/security/advisories/GHSA-4vmc-gm8v-m35h
• https://github.com/gotenberg/gotenberg/security/advisories/GHSA-4vmc-gm8v-m35h