CVE-2026-92543

Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Because the transport re-dials the hostname rather than the CIDR-matching address, a DNS answer set of one loopback IP plus a non-loopback attacker IP disables certificate verification and enables HTTP fallback for the registry connection.

• CWE-295
• CWE-319

• https://github.com/moby/moby/security/advisories/GHSA-7cfq-22r6-qp73

Published

Oct 7, 2026

Last Modified

Oct 8, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92538The LearnPress – WordPress LMS Plugin for Create and Sell On…6.1
• CVE-2026-92539A service account with user-management permissions in one or…6.7
• CVE-2026-9254An unauthenticated OS command injection vulnerability exists…8.7
• CVE-2026-92540The Import and export users and customers WordPress plugin b…7.2
• CVE-2026-92541The Import and export users and customers WordPress plugin b…7.2
• CVE-2026-92542The firewall rules which mark VXLAN datagrams for encryption…6.9
• CVE-2026-92546Authentication bypass by spoofing vulnerability in Keepnet L…7.5
• CVE-2026-92548The WP Popular Posts plugin for WordPress is vulnerable to S…5.3
• CVE-2026-9255Missing input source validation in the tool authorization pr…8.4
• CVE-2026-92550A pre-authentication attacker could leverage type size/count…7.5
• CVE-2026-92551The Paid Membership Plugin, Ecommerce, User Registration For…6.1
• CVE-2026-92553The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Repor…8.8