Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access

A high-severity Docker Engine vulnerability (CVE-2026-34040, CVSS 8.8) allows attackers to bypass authorization plugins and gain full host access.

• •The flaw stems from an incomplete fix for CVE-2024-41110, failing to handle oversized HTTP request bodies (>1MB).
• •An attacker with Docker API access can pad a container creation request to over 1MB, causing the body to be dropped before reaching the AuthZ plugin, which then allows the request.
• •Exploiting this grants a privileged container with root-level host access, exposing AWS credentials, SSH keys, and Kubernetes configs.
• •AI coding agents running in Docker-based sandboxes can be tricked via prompt injection or may independently discover and exploit the bypass during routine debugging tasks.
• •