# Docker Swarm: worker credentials can become manager authority Canonical: https://www.oktsec.com/radar/docker-swarmkit-cve-2026-115539 Publisher: Oktsec Language: en Published: 2026-11-12T23:07:39Z Updated: 2026-11-12T23:07:39Z Record reviewed: 2026-11-12T23:07:39Z Latest evidence check: 2026-11-12T23:07:39Z Disclosed: 2026-11-10 A Swarmkit identity forwarding flaw can allow a holder of valid worker credentials to obtain a manager certificate during specific leader changes. The library is corrected; downstream release availability needs separate verification. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Review this week - Rationale: A valid worker certificate and private key, affected dependencies and a leader transition are required. Swarmkit v2.1.3 is corrected; Docker integration fixes remain unlisted in the reviewed notice. - Evidence: Attacks not established - Verification: Vendor confirmed - Fix status: Additional action required - Exposure requirement: Account access required - Vendor: Moby - Products: Docker Swarm, Swarmkit - CVEs: CVE-2026-115539 ## Technical overview CVE-2026-115539 concerns identity forwarding through a Swarmkit cluster proxy. Exploitation requires a valid worker TLS certificate and its private key, plus a short window after a leader change with two inconsistent forwarding hops. The result can be a manager certificate for the requester’s key. The maintainer identifies Swarmkit v2.1.3 as corrected. It does not list corrected Docker or Moby integration versions. Its Docker range starts at 23.0.0; that version must not be described as the fix. Applications also need the vulnerable Swarmkit code together with grpc-go 1.39 or later to be affected. Actual attacks are not established by the advisory. Oktsec recommends mapping the deployed cluster software to its vendor’s correction, protecting worker certificates and keys, and restricting cluster administration paths. If credentials may have been exposed, preserve evidence and follow the platform’s documented credential recovery procedure. These controls reduce exposure but do not replace a correction. ## Recommended response Update Swarmkit v2 to 2.1.3 where directly embedded. For Docker deployments, verify a release or backport covering this CVE and restrict access to worker credentials and cluster management paths. Relevant to: Teams operating Docker Swarm clusters or embedding Swarmkit in orchestration software. ## CVE attribution - CVE-2026-115539: Moby — Docker Swarm, Swarmkit. [Source](https://github.com/moby/swarmkit/security/advisories/GHSA-628g-hv7f-pgjc) ## Affected systems and fixes ### github.com/moby/swarmkit/v2 Affected: Before 2.1.3, with grpc-go 1.39 or later and the leader forwarding conditions in the advisory. Fixed release / action: 2.1.3 ### Docker and other Moby integrations Affected: The maintainer lists docker/docker >=23.0.0, moby/moby/v2 <=2.0.0-beta.28 and the older swarmkit module from v1.12.1-0.20220307221335-616e8db4c3b0. Fixed release / action: No corrected integration version is listed in the reviewed advisory. Verify a downstream release or backport; the library fix is not evidence that an installed Docker Engine is corrected. Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.10 Checked: 2026-11-13T01:29:19.779Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-13T01:30:03.234Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast - [CVE-2026-115539](https://api.first.org/data/v1/epss?cve=CVE-2026-115539): 0.21% probability of observed exploitation in the next 30 days; percentile 11.69%; score date 2026-11-12. EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-13T01:30:03.234Z. ## Response checklist 1. **Map the running cluster components** — Oktsec recommends identifying Docker or Moby releases and embedded Swarmkit dependencies; a standalone container without Swarm is a different scope. 2. **Verify the correction in the deployed product** — Use Swarmkit v2.1.3 for direct integrations. For Docker or another distribution, obtain confirmation of a release or backport covering CVE-2026-115539 rather than treating the library tag as a Docker fix. 3. **Protect worker identities and review changes** — Oktsec recommends restricting access to node certificates and private keys, reviewing unexpected manager identities and preserving relevant cluster logs if compromise is suspected. ## Relevance to AI environments Agent workloads hosted on a Swarm cluster depend on its node identities and management permissions. Oktsec recommends treating exposed worker keys as infrastructure credentials and reviewing unexpected manager identities. ## Sources - [Swarmkit: forwarded identity can become manager authority](https://github.com/moby/swarmkit/security/advisories/GHSA-628g-hv7f-pgjc) — Moby; Vendor notice; checked 2026-11-12T23:06:28Z ## Editorial record - 2026-11-12T23:07:39Z: Added verified prerequisites, affected versions, correction scope and operational checks. Actual attacks are not established by the reviewed sources. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/docker-swarmkit-cve-2026-115539) · [Build a response plan](https://www.oktsec.com/radar/docker-swarmkit-cve-2026-115539#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=docker-swarmkit-cve-2026-115539&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=docker-swarmkit-cve-2026-115539&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.