Moby is an open source container framework in which a flaw in the daemon’s privilege comparison logic allows the daemon to accept a privilege set that differs from the one approved by the user. For plugins that request exactly one privilege, no comparison is performed at all. An attacker who can supply a plugin to the daemon could therefore install a plugin with elevated privileges without authorization, potentially enabling the execution of arbitrary code or the escalation of privileges within the host environment.

All installations of Moby prior to version 29.3.1 are impacted. This includes any Docker‑compatible daemon running the Moby framework, regardless of operating system, as the vulnerability relies solely on the daemon’s internal privilege‑checking logic.

The CVSS score of 6.8 signifies a medium severity risk, while an EPSS score of less than 1% indicates that exploitation is currently unlikely. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, further supporting a low current threat level. The likely attack vector is inferred to be local or privileged, as an attacker must be able to add a plugin to the daemon to exploit the flaw.