CVE-2017-20198

The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations, attackers can deploy a container that mounts the host's root filesystem (/) with read/write privileges. When using a malicious Docker image, the attacker can write to /etc/cron.d/ on the host, achieving arbitrary code execution with root privileges. This impacts any system where the Docker daemon honors Marathon container configurations without policy enforcement.

• CWE-732

• https://dcos.io/
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dcos_marathon.rb
• https://web.archive.org/web/20230609134421/https://warroom.rsmus.com/dcos-marathon-compromise/
• https://www.exploit-db.com/exploits/42134
• https://www.vulncheck.com/advisories/dcos-marathon-docker-mount-abuse-rce

Published

Jul 23, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-20192The Formidable Form Builder plugin for WordPress is vulnerab…6.1
• CVE-2017-20193The Product Vendors is vulnerable to Reflected Cross-Site Sc…6.1
• CVE-2017-20194The Formidable Form Builder plugin for WordPress is vulnerab…5.3
• CVE-2017-20195A vulnerability was found in LUNAD3v AreaLoad up to 1a110318…5.5
• CVE-2017-20196A vulnerability was found in Itechscripts School Management …6.3
• CVE-2017-20197A vulnerability was found in propanetank Roommate-Bill-Track…7.3
• CVE-2017-20199A vulnerability was found in Buttercup buttercup-browser-ext…6.5
• CVE-2017-2020Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-20200A vulnerability has been found in Coinomi up to 1.7.6. This …3.7
• CVE-2017-20201CCleaner v5.33.6162 and CCleaner Cloud v1.07.3191 (32-bit bu…9.3
• CVE-2017-20202Web Developer for Chrome v0.4.9 contained malicious code tha…9.3
• CVE-2017-20203NetSarang Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 B…9.3