Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115538— Docker Engine overlay-network encryption rules are not restored after a firewalld reload

Quick assessment

Affected
Docker Docker Engine
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Moby 的 overlay 网络驱动程序在 firewalld 删除加密 overlay 网络的相关 iptables 规则后，未能恢复这些规则。与其他 Docker Engine 网络组件不同，overlay 驱动程序无法通过 D-Bus 处理 firewalld 的重新加载或启动信号。缺失的规则会导致发出的 VXLAN 数据报绕过 IPsec 加密，并消除对传入的明文 VXLAN 流量的保护。该问题不会被 dockerd 记录，且会持续存在，直到加密网络的最后一个本地端点被移除并重新添加，或者 dockerd

CVSS 7.0 · High EPSS 0.31% · P24

Possible ATT&CK Techniques 1 AI

T1562.007
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115538

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Docker Engine overlay-network encryption rules are not restored after a firewalld reload
Source: CVE Program / CVE List V5
Vulnerability Description
Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload or start signals over D-Bus. The missing rules cause outgoing VXLAN datagrams to bypass IPsec encryption and remove the protection against incoming cleartext VXLAN traffic. The condition is not logged by dockerd and persists until the encrypted network's last local endpoint is removed and another is added, or dockerd is restarted. Each further firewalld event repeats the condition.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L
Source: CVE Program / CVE List V5
Vulnerability Type
保护机制失效
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Docker Docker Engine 0 ~ 29.9.3 -
Moby Moby 0 ~ v2.0.0-beta.29 -

II. Public POCs for CVE-2026-115538

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115538

请登录查看更多情报信息。

Other References for CVE-2026-115538 (1)

IV. Related Vulnerabilities

Same product: Docker Engine
Same vendor: Docker
Same weakness: CWE-693