CVE WatchOct 8, 2026

CVE-2026-92543

Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/

CVSS

—

No CVSS

EPSS

0.1%

KEV

—

Exploit Today

0-100

Published: Oct 7, 2026 · Last modified: Oct 8, 2026 · CWE-295 · CWE-319

EPSS · 30d

0.1%EPSS · 30 days0.1%

2026-10-082026-10-23

Technical description

Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Because the transport re-dials the hostname rather than the CIDR-matching address, a DNS answer set of one loopback IP plus a non-loopback attacker IP disables certificate verification and enables HTTP fallback for the registry connection.

Official references

github.comhttps://github.com/moby/moby/security/advisories/GHSA-7cfq-22r6-qp73

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-106017—

8.7%

——3Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions.1d CVE-2026-218122.2 LOW

1.7%

——1HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vulnerability when configured to communicate with the AppScan server over HTTP. This could allow an attacker to intercept credentials or authentication tokens during transmission. The plugin has been updated to display a warning when HTTP is used and recommend HTTPS for secure communication.1d CVE-2026-1142209.1 CRI

4.6%

——1NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between the application and the server.1d CVE-2026-963754.8 MED

0.5%

——0Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.1d CVE-2026-87944—

1.3%

——0Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.2d CVE-2026-1146428.7 HIG

5.6%

——2Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend issuing an NTLM or Negotiate challenge, then reach another service on the same keep-alive connection, bypassing its root CAs, server name, and certificate verification.1d