Docker Engine: Overlay encryption not restored after firewalld reload

Summary

Docker Engine (Swarm mode) and Moby do not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Traffic between Swarm nodes is then sent in cleartext and cleartext VXLAN traffic is accepted again, so an attacker on the network path can read or inject container traffic. The condition only affects nodes running firewalld in a configuration that deletes other applications' iptables rules, and it is not logged; it persists until dockerd is restarted.

Affected

• Docker Engine: versions before 29.9.3
• Moby: versions before v2.0.0-beta.29
• Affected nodes: Linux Swarm nodes with at least one task or container on an encrypted overlay network, running firewalld with FirewallBackend=iptables, or with FirewallBackend=nftables without firewalld commit b7faa74 (firewalld 2.0.0 or later, firewalld-1.2.5-1.el9, firewalld-0.9.11-9.el8), or with firewalld direct rules or passthrough rules

Fixed in

• Docker Engine 29.9.3 or later
• Moby v2.0.0-beta.29 or later
• Alpaquita Linux packages: 29.9.3-r0 (per OSV; applies to that distribution only)
• Other distributions: Unknown. Check your vendor's security tracker.

Workaround

• Restart dockerd after every firewalld reload, stop or start; this also restarts the node's Swarm tasks
• Alternatively, use FirewallBackend=nftables with a firewalld build that includes commit b7faa74 and remove all firewalld direct configuration
• Block incoming UDP traffic to the VXLAN port (default 4789) at the Internet boundary; this does not protect the confidentiality of traffic between nodes

Exploitation

• The vendor advisory and CVE record do not mention exploitation.
• A secondary aggregator reports it is not known to be exploited.
• No public proof of concept or exploit was found in research. CISA KEV and Exploit-DB were not checked directly.

Our recommendation

• Check whether Swarm nodes use encrypted overlay networks and firewalld (systemctl is-active firewalld).
• Update Docker Engine to 29.9.3 or later, or Moby to v2.0.0-beta.29 or later.
• Until patched, restart dockerd after every firewalld change.
• Block external access to UDP port 4789.
• Prioritise multi-node Swarm clusters that carry sensitive traffic over untrusted or shared networks.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-6jhp-7446-hf7f github.com
• CVE Record CVE-2026-115538 www.cve.org
• Docker v29.9.3 release notes github.com
• OSV entry BELL-CVE-2026-115538 osv.dev
• Moby pull request 54116 (29.x backport) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:28.