{"id":"CVE-2026-115539","kind":"vulnerability","aliases":["CVE-2026-115539"],"related":[],"title":"SwarmKit: proxy lets a worker node obtain a manager certificate","description":"SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when built with grpc-go 1.39 or later. During a short window after a leader change, two proxy hops through managers with inconsistent views of the leader can allow an attacker possessing a valid worker node TLS certificate and private key to obtain a manager node certificate for the attacker's own key, escalating privileges from worker to manager. Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted.","summary":"SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity, during a short window after a leader change. An attacker holding a valid worker node certificate and key can obtain a manager node certificate for their own key, escalating from worker to manager.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/moby/swarmkit/v2","fixed":[],"affected":"< 2.1.3 (with grpc-go >= 1.39)","ecosystem":"go"},{"name":"github.com/moby/moby/v2","fixed":[],"affected":"<= v2.0.0-beta.28","ecosystem":"go"}],"ecosystems":[],"tags":["docker-swarm","grpc-go","infrastructure","swarmkit"],"not_affected_if":["grpc-go-below-1.39","no-swarm-cluster"],"how_to_check":"Check whether you run Docker Swarm / SwarmKit managers: 'docker info' (Swarm: active) and 'docker version'. For Go builds, run 'go list -m all' and look for github.com/moby/swarmkit/v2 < 2.1.3 together with google.golang.org/grpc >= 1.39. Exposure also needs an attacker holding a valid worker node certificate and key, during a short window after a leader change.","fix":"No patched release is listed in the advisory (Patched versions: None). The advisory marks swarmkit/v2 < 2.1.3 as affected, but the releases page showed only v2.1.2 when checked. Watch moby/swarmkit for v2.1.3 and rebuild Docker/Moby against it.","status":"open","published_at":"2026-11-10T20:18:03+00:00","first_seen_at":"2026-11-10T20:46:01+00:00","triaged_at":"2026-11-10T20:47:42+00:00","updated_at":"2026-11-10T21:03:41+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T20:47:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SwarmKit: proxy lets a worker node obtain a manager certificate","impact":"high","summary":"SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity, during a short window after a leader change. An attacker holding a valid worker node certificate and key can obtain a manager node certificate for their own key, escalating from worker to manager.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["swarmkit","docker-swarm","grpc-go"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker with worker certificate gains manager-level cluster privileges.","analyst_note":"Find the affected and fixed SwarmKit versions and the vendor advisory linked from the NVD entry (github.com) to fill in how_to_check and fix.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-swarm-cluster","grpc-go-below-1.39"],"who_is_affected":"Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted, according to the NVD description. Exposure needs an attacker who already holds a valid worker node TLS certificate and private key, and a cluster where two proxy hops route through managers with inconsistent leader views during a leader change. Teams not running SwarmKit-based clusters can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000747,"input_tokens":4706,"output_tokens":553,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed SwarmKit versions and the vendor advisory linked from the NVD entry (github.com) to fill in how_to_check and fix.","search":"'-115539':13A,16A '-2026':12A,15A '/moby/moby/v2':22A '/moby/swarmkit/v2':19A '1.39':127C,192C 'affect':185C 'allow':150C 'api':35B,88C 'applic':181C 'attack':60B,152C,171C 'built':122C,182C 'certif':10A,66B,74B,159C,168C 'chang':58B,120C,137C 'client':41B,94C 'cluster':34B,87C 'cluster-api':33B,86C 'copi':110C 'cve':11A,14A 'discard':115C 'docker':24B 'docker-swarm':23B 'escal':79B,175C 'forward':40B,93C 'github.com':18A,21A 'github.com/moby/moby/v2':20A 'github.com/moby/swarmkit/v2':17A 'go':28B,126C,191C 'grpc':27B,125C,190C 'grpc-go':26B,124C,189C 'guard':118C 'hold':61B 'hop':140C 'ident':44B,50B,97C,103C 'impact':196C 'incom':113C 'inconsist':144C 'infrastructur':29B 'intermediari':47B,100C 'key':68B,78B,162C,174C 'later':129C,194C 'leader':57B,136C,148C 'let':3A 'manag':9A,48B,72B,83B,101C,142C,166C,180C 'metadata':107C,114C 'node':6A,65B,73B,157C,167C 'obtain':7A,70B,164C 'outgo':106C 'overwrit':38B,91C 'possess':153C 'privat':161C 'privileg':176C 'proxi':2A,36B,89C,139C 'redirect':117C 'replac':105C 'short':53B,132C 'swarm':25B 'swarmkit':1A,30B,31B,84C,186C 'tls':43B,96C,158C 'two':138C 'valid':63B,155C 'version':187C 'view':145C 'window':54B,133C 'withmetadataforwardtlsinfo':104C 'worker':5A,64B,81B,156C,178C","nicknames":[],"mitigations":[],"who_affected":"Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted, according to the NVD description. Exposure needs an attacker who already holds a valid worker node TLS certificate and private key, and a cluster where two proxy hops route through managers with inconsistent leader views during a leader change. Teams not running SwarmKit-based clusters can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["githubcommobymobyv2","githubcommobyswarmkitv2"],"ptokens":["com","github","moby","swarmkit","v2"],"labels":["dockerswarm","grpcgo","high","infrastructure","swarmkit"],"campaign_type":null,"search_a":"'-115539':13A,16A '-2026':12A,15A '/moby/moby/v2':22A '/moby/swarmkit/v2':19A 'certif':10A 'cve':11A,14A 'github.com':18A,21A 'github.com/moby/moby/v2':20A 'github.com/moby/swarmkit/v2':17A 'let':3A 'manag':9A 'node':6A 'obtain':7A 'proxi':2A 'swarmkit':1A 'worker':5A","search_b":"'api':35B 'attack':60B 'certif':66B,74B 'chang':58B 'client':41B 'cluster':34B 'cluster-api':33B 'docker':24B 'docker-swarm':23B 'escal':79B 'forward':40B 'go':28B 'grpc':27B 'grpc-go':26B 'hold':61B 'ident':44B,50B 'infrastructur':29B 'intermediari':47B 'key':68B,78B 'leader':57B 'manag':48B,72B,83B 'node':65B,73B 'obtain':70B 'overwrit':38B 'proxi':36B 'short':53B 'swarm':25B 'swarmkit':30B,31B 'tls':43B 'valid':63B 'window':54B 'worker':64B,81B","search_c":"'1.39':127C,192C 'affect':185C 'allow':150C 'api':88C 'applic':181C 'attack':152C,171C 'built':122C,182C 'certif':159C,168C 'chang':120C,137C 'client':94C 'cluster':87C 'cluster-api':86C 'copi':110C 'discard':115C 'escal':175C 'forward':93C 'go':126C,191C 'grpc':125C,190C 'grpc-go':124C,189C 'guard':118C 'hop':140C 'ident':97C,103C 'impact':196C 'incom':113C 'inconsist':144C 'intermediari':100C 'key':162C,174C 'later':129C,194C 'leader':136C,148C 'manag':101C,142C,166C,180C 'metadata':107C,114C 'node':157C,167C 'obtain':164C 'outgo':106C 'overwrit':91C 'possess':153C 'privat':161C 'privileg':176C 'proxi':89C,139C 'redirect':117C 'replac':105C 'short':132C 'swarmkit':84C,186C 'tls':96C,158C 'two':138C 'valid':155C 'version':187C 'view':145C 'window':133C 'withmetadataforwardtlsinfo':104C 'worker':156C,178C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:50:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@docker.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115539","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115539","severity":null,"published_at":"2026-11-10T20:18:03+00:00","modified_at":"2026-11-10T20:18:03+00:00","first_seen_at":"2026-11-10T20:46:01+00:00","fetched_at":"2026-11-10T20:46:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115539:2745","url":null,"severity":null,"published_at":"2026-11-10T21:03:41+00:00","modified_at":"2026-11-10T21:03:41+00:00","first_seen_at":"2026-11-10T21:03:41+00:00","fetched_at":"2026-11-10T21:03:41+00:00","note":"Read GHSA-628g-hv7f-pgjc. Affected: swarmkit/v2 <2.1.3, swarmkit >= v1.12.1-0.20220307221335-616e8db4c3b0, moby/moby/v2 <= v2.0.0-beta.28, with grpc-go >= 1.39. Advisory lists Patched: None; releases page shows only v2.1.2, so no fixed release confirmed. No PoC, no exploitation seen."}],"documents":[{"id":118130,"url":"https://github.com/moby/swarmkit/security/advisories/GHSA-628g-hv7f-pgjc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T19:50:12+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}