Docker Engine

Vulnerability in Docker go-archive Library Allows File Creation and Overwrite Outside Target Directory

A vulnerability has been identified in the go-archive archive processing library used by Docker and related software. The flaw, tracked as CVE-2026-17106, affects the Unpack, UnpackLayer, and Untar functions and permits files to be created or overwritten outside the intended extraction directory. The issue stems from a mismatch between the path string validated by the code and the actual path resolved by the operating system. Docker rated the vulnerability 7.1 under CVSS v4.0 and classified it as High severity. A proof-of-concept exploit has already been published for macOS and Linux. The fix was implemented in go-archive 0.3.0 and shipped in Docker Engine 29.7.0, Docker CLI 29.7.0, and Docker Desktop 4.86.0.

Where Secrets Really End Up in Docker Images: Testing 8 Common Methods

A detailed analysis of eight different approaches for handling secrets during Docker image builds reveals that most methods leave sensitive data exposed in layers, configuration files, or build history. Experiments conducted on Ubuntu 24.04.1 LTS with Docker Engine 29.1.3 and BuildKit v0.26.2 showed that simply using RUN rm after COPY or overwriting files fails to remove secrets from immutable layers. Environment variables via ENV and build arguments via ARG both persist in image metadata and history. Only BuildKit Secrets with --mount=type=secret and multi-stage builds that avoid copying secrets into the final stage successfully prevent leakage. The study demonstrates that secrets can be extracted from saved images without running any containers. Developers are advised to adopt these two secure patterns to protect credentials in container supply chains.