IT SBIT Services
Schneeberger
DEEN
CVE tracker

moby SwarmKit: Privilege escalation from worker to manager in Cluster-API proxy

CVE-2026-115539High 7.7

← All vulnerabilities

Summary

SwarmKit, the orchestration toolkit behind Docker Swarm mode, has a flaw in its Cluster-API proxy that can overwrite a forwarded client's TLS identity with that of an intermediary manager. An attacker holding a valid worker node TLS certificate and private key can, during a short window after a leader change and through two proxy hops with inconsistent leader views, obtain a manager node certificate for their own key. This escalates privileges from worker to manager, which gives control over the whole cluster. The flaw affects applications built with an affected SwarmKit version and grpc-go 1.39 or later.

Affected

  • github.com/moby/swarmkit/v2 before 2.1.3
  • SwarmKit from 1.12.1-0.20220307221335-616e8db4c3b0 (per CVE record, status unclear)
  • Docker Engine from 23.0.0 (per CVE record; status of fixed builds unclear)
  • Moby up to 2.0.0-beta.28 (per CVE record)
  • Custom Go applications embedding a vulnerable SwarmKit version and grpc-go 1.39 or later

Fixed in

  • github.com/moby/swarmkit/v2 version 2.1.3 or later (per GHSA advisory)
  • Docker Engine 29.9.3 is reported as containing the fix by secondary sources; verify against Docker's official release notes.

Workaround

Unknown. No documented workaround was found; the vendor path is to upgrade.

Exploitation

  • No known exploitation at the time of research.
  • Not listed in CISA KEV; no public proof of concept found.
  • The CVE was published on 10 November 2026, so the status may change quickly.

Our recommendation

  • Check whether Docker Swarm mode or custom Go applications using SwarmKit are in use; if not, no action is needed.
  • Upgrade SwarmKit to 2.1.3 or later and rebuild affected custom applications; update Docker Engine to a release that contains the fix.
  • Limit who can obtain worker join tokens, review node membership for unknown nodes, and rotate or revoke certificates for any worker that may be compromised.
  • Treat as moderate priority for Swarm users and patch in the next maintenance window; treat as higher priority if workers run on less-trusted hosts.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:46.

Original description (NVD)

SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when built with grpc-go 1.39 or later. During a short window after a leader change, two proxy hops through managers with inconsistent views of the leader can allow an attacker possessing a valid worker node TLS certificate and private key to obtain a manager node certificate for the attacker's own key, escalating privileges from worker to manager. Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed