Docker Engine v29.6.2

v29.6.2
Changed 3
  • Update containerd (static binaries) to v2.2.6
  • Update Go runtime to 1.26.5
  • Update RootlessKit to v3.0.2
Security 5
  • Fix command injection vulnerability in Git source checkout from a bundle file (CVE-2026-15793)
  • Fix panic caused by incorrect parameters sent from a frontend (CVE-2026-15792)
  • Fix LLB file operation that could be tricked into removing contents of the /tmp directory (CVE-2026-15791)
  • Fix bypass of destination directory validation when uploading local sources by a malicious client (CVE-2026-15789)
  • Fix WCOW cache mount source selector that could resolve NTFS junctions outside of the cache root (CVE-2026-15788)

From Docker Engine

29.6.2

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Security

This release includes fixes for multiple security vulnerabilities affecting Docker Engine.

  • CVE-2026-15793: Git source checkout from a bundle file could lead to command injection. GHSA-hw3h-2gp9-cxpv
  • CVE-2026-15792: Incorrect parameters sent from a frontend could cause a panic. GHSA-qx3x-mv6r-52p6
  • CVE-2026-15791: An LLB file operation could be tricked into removing the contents of the /tmp directory. GHSA-32pv-7hq5-qhwq
  • CVE-2026-15789: A malicious client could bypass destination directory validation when uploading local sources. GHSA-g2h8-426c-7976
  • CVE-2026-15788: A WCOW cache mount source selector could resolve NTFS junctions outside of the cache root. GHSA-388v-wmr2-g2v2
Packaging updates
Rootless
View original

Upgraded? How did it go?

Discussion