CVE-2026-115538

{
  "etk_id": "ETK-2026-4093",
  "cve_id": "CVE-2026-115538",
  "display_id": "CVE-2026-115538",
  "ghsa_id": "GHSA-6jhp-7446-hf7f",
  "euvd_id": "EUVD-2026-122881",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Encrypted overlay rule restoration failure in Docker Engine",
  "summary": "Docker Engine encrypted overlay networks can lose their firewall enforcement after firewalld reloads or startup events. An attacker able to interact with the affected network may observe unencrypted VXLAN traffic or send cleartext VXLAN traffic while the rules remain absent; an encrypted overlay network and a firewalld event are required.",
  "mitigation": "Upgrade Docker Engine to 29.9.3 or later, or upgrade github.com/moby/moby/v2 to v2.0.0-beta.29 or later. Until upgraded, restart dockerd after firewalld events to restore the affected network rules.",
  "vendor": "Docker",
  "product": "Docker Engine",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 29.9.3"
      ],
      "ecosystem": "docker",
      "fixed_versions": [
        "29.9.3"
      ],
      "package_name": "Docker Engine",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "<=v2.0.0-beta.28"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "v2.0.0-beta.29"
      ],
      "package_name": "github.com/moby/moby/v2",
      "purl": "pkg:golang/github.com/moby/moby/v2"
    }
  ],
  "cwes": [
    693
  ],
  "cvss_score": 7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 13.57530135,
  "t0_at": "2026-11-10T19:58:45.360000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-10T19:58:45.360000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-10T19:58:45.360000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115538"
    }
  }
}