Docker Authorization Bypass Flaw Exposed Hosts to Potential Attackers

A high-severity authorization bypass in Docker Engine (CVE-2026-34040) lets local, low-privileged attackers send crafted API requests that strip the request body before AuthZ plugin evaluation, enabling actions the plugin would otherwise block; it affects Docker Engine versions prior to 29.3.1 when AuthZ plugins are used. Administrators should upgrade to 29.3.1 immediately; if patching is not possible, mitigate by restricting Docker API access and avoiding AuthZ plugins that depend on request-body inspection.