{"id":"CVE-2026-92543","revision":"eb84ae57d442457d90b58fd916eba74e","records":[{"revision":"eb84ae57d442457d90b58fd916eba74e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-92543","aliases":[],"title":"Docker Engine insecure-registry fallback via malicious DNS responses","description":"Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Because the transport re-dials the hostname rather than the CIDR-matching address, a DNS answer set of one loopback IP plus a non-loopback attacker IP disables certificate verification and enables HTTP fallback for the registry connection.","state":0,"publishedAt":"2026-10-07T16:44:21.237+00:00","modifiedAt":"2026-10-07T20:31:28.77+00:00","affected":[{"ecosystem":"Vendor product","name":"Docker Engine","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"Docker Engine\",\n                    \"vendor\": \"Docker\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"lessThan\": \"29.8.2\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"github.com/moby/moby/v2","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageName\": \"github.com/moby/moby/v2\",\n                    \"product\": \"Moby\",\n                    \"vendor\": \"Moby\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"lessThan\": \"v2.0.0-beta.25\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":7.6,"severity":"HIGH"}],"references":["https://github.com/moby/moby/security/advisories/GHSA-7cfq-22r6-qp73"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-92543","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-92543","identifiers":["CVE-2026-92543"]},"retained":false,"historicalAffected":[]}],"coverage":[]}