---
id: "CVE-2026-115538"
page: "https://infrastack.ai/live/CVE-2026-115538"
kind: "vulnerability"
aliases: ["CVE-2026-115538"]
title: "Docker Engine: encrypted overlay networks lose firewall rules after firewalld reload"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Docker Engine", "fixed": ["29.9.3"], "affected": "< 29.9.3", "ecosystem": "vendor"}, {"name": "moby", "fixed": ["v2.0.0-beta.29"], "affected": "<= v2.0.0-beta.28", "ecosystem": "vendor"}]
ecosystems: []
tags: ["docker", "firewalld", "linux", "moby", "overlay-network", "runtime", "swarm"]
not_affected_if: ["nftables-with-firewalld-2.0", "no-encrypted-overlay", "no-firewalld", "no-swarm", "single-host-bridge-networks"]
published_at: "2026-11-10T20:18:03+00:00"
first_seen_at: "2026-11-10T20:46:01+00:00"
updated_at: "2026-11-10T21:04:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115538", "first_seen_at": "2026-11-10T20:46:01+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T21:04:46+00:00"}]
exploit_sources: []
---

# Docker Engine: encrypted overlay networks lose firewall rules after firewalld reload

Link for people: https://infrastack.ai/live/CVE-2026-115538 (this .md is for agents)

Moby's overlay network driver does not restore iptables rules for encrypted overlay networks after firewalld deletes them. As a result, VXLAN traffic can bypass IPsec encryption and incoming cleartext VXLAN traffic is no longer blocked.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Docker Engine affected < 29.9.3 fixed 29.9.3
- vendor:moby affected <= v2.0.0-beta.28 fixed v2.0.0-beta.29

## How to check

1. Affected only if the node is in a Swarm with a task/container attached to an encrypted overlay network (created with --opt encrypted; check 'docker network inspect <net>' for Options.encrypted) AND firewalld is running (systemctl is-active firewalld).
2. Check 'docker version' (Engine < 29.9.3 is affected).
3. Check firewalld: 'grep FirewallBackend /etc/firewalld/firewalld.conf'. Affected if the backend is iptables, or nftables with firewalld < 2.0.0 (no commit b7faa74; Debian 12 1.3.3 and Ubuntu 22.04 1.1.1 are affected; RHEL 9 >= 1.2.5-1.el9 and RHEL 8 >= 0.9.11-9.el8 are not), or any direct rules exist ('firewall-cmd --direct --get-all-rules').
4. If a firewalld reload/restart has happened since dockerd started, the rules may be missing: 'iptables -t mangle -S OUTPUT' should show VXLAN marks for the network VNI.

## Fix

Upgrade Docker Engine to 29.9.3 (moby v2.0.0-beta.29). Until then: use FirewallBackend=nftables with firewalld >= 2.0.0 (or RHEL backports 1.2.5-1.el9 / 0.9.11-9.el8) and no direct rules, or restart dockerd after every firewalld reload/stop/start (this restarts the node's Swarm tasks).

## Timeline

- 2026-11-10T20:46:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115538
- 2026-11-10T21:04:46+00:00 analyst — Read GHSA-6jhp-7446-hf7f (moby maintainers): Docker Engine <29.9.3 fixed in 29.9.3; moby v2 <=beta.28 fixed in beta.29. Lower bound and other backport branches not stated.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/moby/moby/security/advisories/GHSA-6jhp-7446-hf7f

## From the sources

Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload or start signals over D-Bus. The missing rules cause outgoing VXLAN datagrams to bypass IPsec encryption and remove the protection against incoming cleartext VXLAN traffic. The condition is not logged by dockerd and persists until the encrypted network's last local endpoint is removed and another is added, or dockerd is restarted. Each further firewalld event repeats the condition.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_