GITHUB.COM/MOBY/SWARMKIT/V2 · CVE-2026-115539 · Infrastructure
NO FIX YET · SEE WHAT TO DO
SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity, during a short window after a leader change. An attacker holding a valid worker node certificate and key can obtain a manager node certificate for their own key, escalating from worker to manager.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted, according to the NVD description. Exposure needs an attacker who already holds a valid worker node TLS certificate and private key, and a cluster where two proxy hops route through managers with inconsistent leader views during a leader change. Teams not running SwarmKit-based clusters can skip it.
Not affected if grpc-go-below-1.39, no-swarm-cluster
Who cares docker-swarm, grpc-go, swarmkit
docker info (Swarm: active) and docker versiongo list -m all and look for github.com/moby/swarmkit/v2 < 2.1.3 together with google.golang.org/grpc >= 1.39SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when built with grpc-go 1.39 or later. During a short window after a leader change, two proxy hops through managers with inconsistent views of the leader can allow an attacker possessing a valid worker node TLS certificate and private key to obtain a manager node certificate for the attacker's own key, escalating privileges from worker to manager. Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
2.1.3 as affected, but the releases page showed only v2.1.2 when checkedv2.1.3 and rebuild Docker/Moby against it