CRITICAL BUG IN DOCKER ENGINE ALLOWED ATTACKERS TO BYPASS AUTHORIZATION PLUGINS

Summary from the TLDR InfoSec newsletter

A critical bug in Docker Engine lets attackers bypass authorization plugins in certain versions by sending API requests with no content, leading to potential unauthorized actions like privilege escalation. The vulnerability, tracked as CVE-2024-41110, affects specific versions of Docker Engine up to v27.1.0 and Docker Desktop up to version 4.32.0. It can be mitigated by updating to the latest patched versions, avoiding AuthZ plugins, and restricting access to the Docker API.