A flaw in the Moby container framework allows an attacker to bypass authorization plugins by submitting an oversized request body. This privilege escalation can grant the attacker the ability to perform actions that normally require explicit authorization, potentially compromising the confidentiality, integrity and availability of the container environment. The weakness is classified under CWE‑288 and CWE‑807 and carries a CVSS score of 8.8.

All versions of Moby released before 29.3.1 are affected. The vulnerability was fixed in release 29.3.1 and later versions are not vulnerable.

The CVSS base score indicates significant risk, while the EPSS value of less than 1% suggests that public exploitation is currently uncommon. The vulnerability is not listed in CISA’s KEV catalog. The likely attack path requires direct network access to the Moby service and involves crafting a request that exceeds the expected body size to trigger the authorization bypass.