Go/github.com/docker/docker CVE-2026-42306: unknown, EPSS 0.10%

Race condition in 'docker cp' in github.com/docker/docker allows bind mount redirection

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-5617
• https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh

CVE-2026-42306 · published 2026-06-25T22:34:34Z · modified 2026-07-28T16:30:26.475155486Z · JSON