---
id: CVE-2026-41568
aliases:
  - GO-2026-5668
  - GHSA-vp62-88p7-qqf5
title: >-
  Race condition in 'docker cp' in github.com/docker/docker allows creation of
  arbitrary files
summary: >-
  Race condition in 'docker cp' in github.com/docker/docker allows creation of
  arbitrary files
severity: none
vendor: docker
product: github.com/docker/docker
ecosystem: go
affected:
  - github.com/docker/docker
  - github.com/moby/moby
  - github.com/moby/moby/v2 < 2.0.0-beta.14
patched:
  - github.com/moby/moby/v2 2.0.0-beta.14
published: '2026-06-25'
updated: '2026-08-11'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-5668'
references:
  - url: 'https://github.com/moby/moby/security/advisories/GHSA-vp62-88p7-qqf5'
tags:
  - osv
  - go
epss: 0.00108
epssPercentile: 0.0136
ingestedAt: '2026-08-12T19:18:08.821Z'
---

## Overview

A race condition in the Docker daemon allows an attacker to create arbitrary empty files on the host system during a "docker cp" operation by swapping a destination path with a symbolic link.

The affected code is in the daemon package, specifically the openContainerFS and createIfNotExists methods. This is daemon-owned, Linux-specific code and is not intended for external use as a Go library.

## Affected packages

- `github.com/docker/docker`
- `github.com/moby/moby`
- `github.com/moby/moby/v2 < 2.0.0-beta.14`

## Remediation

Upgrade to a patched release:

- `github.com/moby/moby/v2 2.0.0-beta.14`