{"id":"AZL-113567","summary":"CVE-2026-115539 affecting package moby-engine 25.0.18-2","details":"SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when built with grpc-go 1.39 or later. During a short window after a leader change, two proxy hops through managers with inconsistent views of the leader can allow an attacker possessing a valid worker node TLS certificate and private key to obtain a manager node certificate for the attacker's own key, escalating privileges from worker to manager. Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted.","modified":"2026-11-13T14:17:23.206742134Z","published":"2026-11-10T20:18:03Z","upstream":["CVE-2026-115539"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115539"}],"affected":[{"package":{"name":"moby-engine","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/moby-engine"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"25.0.18-2"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-113567.json"}}],"schema_version":"1.9.2"}