A critical flaw has been found in Docker Engine, potentially enabling attackers to bypass security authorization plugins (AuthZ) in certain situations.

Identified as CVE-2026-34040 (CVSS score: 8.8), the weakness is due to an incomplete solution to CVE-2024-41110, a highly severe vulnerability in the same area discovered in July 2024.

“By sending a specially crafted API call, an attacker could force the Docker daemon to forward the request to an authorization plugin without including the body,” Docker Engine developers stated in a recent security advisory. “The authorization plugin might then approve a request that it would normally block if the full request had been provided.”

“Anyone relying on authorization plugins that examine the request body for access control is at risk.”

Multiple researchers, including Asim Viladi Oglu Manizada, Cody, Oleh Konko, and Vladimir Tokarev, are credited with independently finding and reporting the bug. The issue has been addressed in Docker Engine version 29.3.1.

A report by Cyera Research Labs’ Tokarev explains that the vulnerability arises because the patch for CVE-2024-41110 failed to properly manage excessively large HTTP requests. This allows a scenario where a padded HTTP request could be exploited to create a privileged container with access to the host’s file system.

In a theoretical exploit, an attacker with Docker API access restricted by an AuthZ plugin could circumvent this protection by inflating a container creation request beyond 1MB, causing it to be dropped before it reaches the plugin.

“The plugin approves the request because it doesn’t see anything to reject,” Tokarev explained in a report shared with The Hacker News. “The Docker daemon then fully processes the request, creating a privileged container with root privileges to the host, granting access to sensitive data like AWS credentials, SSH keys, Kubernetes configurations, and everything else on the machine. This flaw affects all AuthZ plugins in the Docker ecosystem.”

Furthermore, an AI coding assistant like OpenClaw running within a Docker sandbox could be manipulated. By hiding a prompt injection within a specially designed GitHub repository, which is then used as part of a standard developer workflow, malicious code can be executed. This code exploits CVE-2026-34040 to bypass authorization and create a privileged container, mounting the host file system.

With this elevated access, the attacker can steal credentials for cloud services and use them to compromise cloud accounts, Kubernetes clusters, and even gain SSH access to production servers.

The problem doesn’t stop there. Cyera also warned that AI agents can discover the bypass on their own. They can trigger it by creating a padded HTTP request when they encounter errors during legitimate debugging tasks initiated by a developer, such as when attempting to access files like kubeconfig (e.g., when debugging a K8s out-of-memory issue). This eliminates the need to use a malicious repository containing exploit instructions.

“The AuthZ plugin denied the mount request,” Cyera explained. “The agent has Docker API access and understands how HTTP works. CVE-2026-34040 doesn’t need exploit code, elevated permissions, or specialized tools. It’s simply an HTTP request with extra padding. Any agent capable of reading Docker API documentation can create it.”

As temporary mitigation steps, it’s advisable to avoid AuthZ plugins that depend on inspecting request bodies for security purposes, restrict Docker API access to authorized users based on the principle of least privilege, or operate Docker in rootless mode.

“In rootless mode, even a privileged container’s ‘root’ account maps to an unprivileged user ID on the host,” Tokarev explained. “This reduces the potential damage from a ‘full host compromise’ to a ‘compromised unprivileged user.’ For environments unable to fully transition to rootless mode, using –userns-remap provides similar user ID mapping.”