{"id":"CVE-2026-115538","kind":"vulnerability","aliases":["CVE-2026-115538"],"related":[],"title":"Docker Engine: encrypted overlay networks lose firewall rules after firewalld reload","description":"Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload or start signals over D-Bus. The missing rules cause outgoing VXLAN datagrams to bypass IPsec encryption and remove the protection against incoming cleartext VXLAN traffic. The condition is not logged by dockerd and persists until the encrypted network's last local endpoint is removed and another is added, or dockerd is restarted. Each further firewalld event repeats the condition.","summary":"Moby's overlay network driver does not restore iptables rules for encrypted overlay networks after firewalld deletes them. As a result, VXLAN traffic can bypass IPsec encryption and incoming cleartext VXLAN traffic is no longer blocked.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Docker Engine","fixed":["29.9.3"],"affected":"< 29.9.3","ecosystem":"vendor"},{"name":"moby","fixed":["v2.0.0-beta.29"],"affected":"<= v2.0.0-beta.28","ecosystem":"vendor"}],"ecosystems":[],"tags":["docker","firewalld","linux","moby","overlay-network","runtime","swarm"],"not_affected_if":["nftables-with-firewalld-2.0","no-encrypted-overlay","no-firewalld","no-swarm","single-host-bridge-networks"],"how_to_check":"1. Affected only if the node is in a Swarm with a task/container attached to an encrypted overlay network (created with --opt encrypted; check 'docker network inspect <net>' for Options.encrypted) AND firewalld is running (systemctl is-active firewalld).\n2. Check 'docker version' (Engine < 29.9.3 is affected).\n3. Check firewalld: 'grep FirewallBackend /etc/firewalld/firewalld.conf'. Affected if the backend is iptables, or nftables with firewalld < 2.0.0 (no commit b7faa74; Debian 12 1.3.3 and Ubuntu 22.04 1.1.1 are affected; RHEL 9 >= 1.2.5-1.el9 and RHEL 8 >= 0.9.11-9.el8 are not), or any direct rules exist ('firewall-cmd --direct --get-all-rules').\n4. If a firewalld reload/restart has happened since dockerd started, the rules may be missing: 'iptables -t mangle -S OUTPUT' should show VXLAN marks for the network VNI.","fix":"Upgrade Docker Engine to 29.9.3 (moby v2.0.0-beta.29). Until then: use FirewallBackend=nftables with firewalld >= 2.0.0 (or RHEL backports 1.2.5-1.el9 / 0.9.11-9.el8) and no direct rules, or restart dockerd after every firewalld reload/stop/start (this restarts the node's Swarm tasks).","status":"open","published_at":"2026-11-10T20:18:03+00:00","first_seen_at":"2026-11-10T20:46:01+00:00","triaged_at":"2026-11-10T20:47:57+00:00","updated_at":"2026-11-10T21:04:46+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-11-10T20:47:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Docker Engine: encrypted overlay networks lose firewall rules after firewalld reload","impact":"medium","summary":"Moby's overlay network driver does not restore iptables rules for encrypted overlay networks after firewalld deletes them. As a result, VXLAN traffic can bypass IPsec encryption and incoming cleartext VXLAN traffic is no longer blocked.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["docker","moby","firewalld","swarm","overlay-network","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"VXLAN traffic leaves unencrypted and cleartext VXLAN traffic gets in.","analyst_note":"Find the affected and fixed Docker Engine versions in the GitHub vendor advisory before writing how_to_check and fix.","how_to_check":"- Check whether the host runs firewalld and whether Docker Swarm encrypted overlay networks are in use (`docker network ls --filter driver=overlay`).\n- Check the Docker Engine version with `docker version`.\n- unknown for the exact affected version range, since the sources do not list it.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-firewalld","no-encrypted-overlay","single-host-bridge-networks"],"who_is_affected":"Teams running Docker Engine with encrypted overlay networks, typically Swarm clusters, on hosts where firewalld is active and reloads or restarts. Hosts without firewalld or without encrypted overlay networks are not exposed to this condition. The sources do not give the exact affected versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000786,"input_tokens":4664,"output_tokens":640,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Docker Engine versions in the GitHub vendor advisory before writing how_to_check and fix.","search":"'-115538':14A,17A '-2026':13A,16A 'add':148C 'anoth':146C 'block':65B 'bus':105C 'bypass':54B,114C 'caus':109C 'cleartext':59B,123C 'compon':90C 'condit':127C,159C 'cve':12A,15A 'd':104C 'd-bus':103C 'datagram':112C 'delet':46B,83C 'docker':1A,18A,21B,87C 'dockerd':132C,150C 'driver':34B,70C,93C 'encrypt':3A,41B,56B,78C,116C,137C 'endpoint':142C 'engin':2A,88C 'engine':19A 'event':156C 'firewal':7A 'firewalld':10A,22B,45B,82C,97C,155C 'handl':96C 'incom':58B,122C 'ipsec':55B,115C 'iptabl':38B,75C 'last':140C 'linux':23B 'local':141C 'log':130C 'longer':64B 'lose':6A 'miss':107C 'mobi':24B,30B,66C 'moby':20A 'network':5A,27B,33B,43B,69C,80C,89C,138C 'outgo':110C 'overlay':4A,26B,32B,42B,68C,79C,92C 'overlay-network':25B 'persist':134C 'protect':120C 'reload':11A,98C 'remov':118C,144C 'repeat':157C 'restart':152C 'restor':37B,73C 'result':50B 'rule':8A,39B,76C,108C 'runtim':28B 'signal':101C 'start':100C 'swarm':29B 'traffic':52B,61B,125C 'unlik':85C 'vxlan':51B,60B,111C,124C","nicknames":[],"mitigations":[],"who_affected":"Swarm nodes running Docker Engine before 29.9.3 with at least one container or task on an encrypted overlay network (off by default) and firewalld running in a setup where it deletes other apps' iptables rules (iptables backend, older nftables-backend builds, or any direct rules). A firewalld reload, restart or start then leaves VXLAN traffic in cleartext and lets someone who can send UDP to port 4789 inject frames. Skip it if you do not use encrypted overlay networks, do not run Swarm, or have no firewalld.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:04:46Z","by":"analyst","doc":"https://github.com/moby/moby/security/advisories/GHSA-6jhp-7446-hf7f","run_id":2746},"products":{"at":"2026-11-10T21:04:46Z","by":"analyst","doc":"https://github.com/moby/moby/security/advisories/GHSA-6jhp-7446-hf7f","run_id":2746},"workarounds":{"at":"2026-11-10T21:04:46Z","by":"analyst","doc":"https://github.com/moby/moby/security/advisories/GHSA-6jhp-7446-hf7f","run_id":2746},"how_to_check":{"at":"2026-11-10T21:04:46Z","by":"analyst","doc":"https://github.com/moby/moby/security/advisories/GHSA-6jhp-7446-hf7f","run_id":2746},"who_affected":{"at":"2026-11-10T21:04:46Z","by":"analyst","doc":"https://github.com/moby/moby/security/advisories/GHSA-6jhp-7446-hf7f","run_id":2746}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["dockerengine","engine","moby"],"ptokens":["docker","engine","moby"],"labels":["docker","firewalld","high","linux","moby","overlaynetwork","runtime","swarm"],"campaign_type":null,"search_a":"'-115538':14A,17A '-2026':13A,16A 'cve':12A,15A 'docker':1A,18A 'encrypt':3A 'engin':2A 'engine':19A 'firewal':7A 'firewalld':10A 'lose':6A 'moby':20A 'network':5A 'overlay':4A 'reload':11A 'rule':8A","search_b":"'block':65B 'bypass':54B 'cleartext':59B 'delet':46B 'docker':21B 'driver':34B 'encrypt':41B,56B 'firewalld':22B,45B 'incom':58B 'ipsec':55B 'iptabl':38B 'linux':23B 'longer':64B 'mobi':24B,30B 'network':27B,33B,43B 'overlay':26B,32B,42B 'overlay-network':25B 'restor':37B 'result':50B 'rule':39B 'runtim':28B 'swarm':29B 'traffic':52B,61B 'vxlan':51B,60B","search_c":"'add':148C 'anoth':146C 'bus':105C 'bypass':114C 'caus':109C 'cleartext':123C 'compon':90C 'condit':127C,159C 'd':104C 'd-bus':103C 'datagram':112C 'delet':83C 'docker':87C 'dockerd':132C,150C 'driver':70C,93C 'encrypt':78C,116C,137C 'endpoint':142C 'engin':88C 'event':156C 'firewalld':82C,97C,155C 'handl':96C 'incom':122C 'ipsec':115C 'iptabl':75C 'last':140C 'local':141C 'log':130C 'miss':107C 'mobi':66C 'network':69C,80C,89C,138C 'outgo':110C 'overlay':68C,79C,92C 'persist':134C 'protect':120C 'reload':98C 'remov':118C,144C 'repeat':157C 'restart':152C 'restor':73C 'rule':76C,108C 'signal':101C 'start':100C 'traffic':125C 'unlik':85C 'vxlan':111C,124C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:49:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@docker.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115538","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115538","severity":null,"published_at":"2026-11-10T20:18:03+00:00","modified_at":"2026-11-10T20:18:03+00:00","first_seen_at":"2026-11-10T20:46:01+00:00","fetched_at":"2026-11-10T20:46:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115538:2746","url":null,"severity":null,"published_at":"2026-11-10T21:04:46+00:00","modified_at":"2026-11-10T21:04:46+00:00","first_seen_at":"2026-11-10T21:04:46+00:00","fetched_at":"2026-11-10T21:04:46+00:00","note":"Read GHSA-6jhp-7446-hf7f (moby maintainers): Docker Engine <29.9.3 fixed in 29.9.3; moby v2 <=beta.28 fixed in beta.29. Lower bound and other backport branches not stated."}],"documents":[{"id":118129,"url":"https://github.com/moby/moby/security/advisories/GHSA-6jhp-7446-hf7f","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T19:49:37+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}