# CVE-2026-92542: Blind VXLAN injection into encrypted overlay networks from cluster peer

> CVE-2026-92542: Blind VXLAN injection into encrypted overlay networks from cluster peer. CVSS 6.9 (CVSS 4.0).

Canonical: https://rewindex.com/cve/CVE-2026-92542
Last updated: 2026-10-08T20:46:35Z

- Published: 2026-10-07 16:42 UTC · Updated: 2026-10-08 20:46 UTC · Assigner: Docker
- CVSS: 6.9 (CVSS 4.0) · Severity: Medium
- EPSS: 0.07%, 0th percentile (scored 2026-10-25)
- CISA KEV: no

## Description

The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encrypted with the overlay-network IPsec parameters which meets the following criteria: - UDP datagram - Destination port is the Swarm data-path port - Datagram starts with a VXLAN header for the VNI of an encrypted overlay network which any running container on the node is connected to

## Affected vendors and products

- Docker: Docker Engine
- Docker: Docker Engine overlay network driver
- Moby: Moby overlay network driver

## Tracked companies

- [Docker](https://rewindex.com/company/docker.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-92542)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-92542)
- [https://github.com/moby/moby/security/advisories/GHSA-6m9p-4h64-m6vh](https://github.com/moby/moby/security/advisories/GHSA-6m9p-4h64-m6vh)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-92542 · Markdown: https://rewindex.com/cve/CVE-2026-92542.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-92542 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:11:51.264Z