Docker 29.8.2: the DNS answer that turns off TLS for your registry

Docker Engine 29.8.2, released on 30 September 2026, fixes three Engine vulnerabilities and ten in BuildKit¹. The one to act on first is CVE-2026-92543. A crafted DNS answer can make the daemon skip TLS certificate verification for a registry, or fall back to plain HTTP. That can hand your registry credentials to someone else, or put their image under your tag¹.

This article explains how that bug works, which hosts are exposed, how to confirm the fix is really running, and what the advisory suggests if you cannot upgrade today. It then covers the BuildKit fixes, which matter most on shared CI builders.

A DNS answer can switch off TLS for your registry

The daemon decides whether a registry is "insecure" by resolving its hostname and checking the answers. According to the advisory, that check is any-match: one matching address in the answer set is enough².

The connection then dials the hostname again, not the address that matched. So an answer containing one loopback address plus one attacker address does two things: the loopback address gets the registry classed as insecure, and the connection can land on the attacker's host. The result is certificate verification disabled and HTTP fallback enabled for that registry².

What the attacker gets

The advisory names two outcomes²:

• Credentials: registry credentials the daemon sends in X-Registry-Auth go to an attacker-controlled host. That host's certificate would normally be rejected, but the check is now off.
• Image substitution: a tag you trust resolves to the attacker's manifest and layers, and those land in the daemon's image store.

The second is the supply-chain case. Your CI pulls registry.example.com/base:22, gets someone else's image, and builds on top of it. Nothing in the build log looks different.

Why a trusted CA certificate does not help

The usual defence against a man in the middle is to pin the registry's CA. The advisory says that does not mitigate this bug if the registry hostname can also resolve to a loopback address. The insecure classification permits connections without certificate verification, so the CA is never checked².

Who is exposed

The attacker needs to influence the DNS answers your daemon receives. These are the places that is easiest:

• CI runners on shared or cloud networks. Their resolvers are rarely yours, and they pull from private registries with real credentials on every job.
• Developer machines on networks you do not control: cafés, conferences, hotels.
• Any host whose resolver, or the path to it, is not trusted.

The bug is in how the Engine treats the answers, so a host with a trustworthy resolver is at lower risk. "Lower" is not "none". Upgrade either way.

To see which address ranges your daemon treats as insecure, ask it:

$ docker info --format '{{json .RegistryConfig.InsecureRegistryCIDRs}}'

If loopback ranges appear in that list, any registry hostname that resolves to a loopback address is classed as insecure. That classification is the mechanism the advisory describes.

Upgrade the daemon, then prove it

The fix is in 29.8.2¹³. The client and daemon can run different versions, so check the server:

$ docker version --format '{{.Server.Version}}'

On Debian or Ubuntu with Docker's apt repository:

$ sudo apt-get update$ sudo apt-get install --only-upgrade docker-ce docker-ce-cli containerd.io docker-buildx-plugin$ sudo systemctl restart docker$ docker version --format '{{.Server.Version}}'

If you are on the 25.0 line, 25.0.18 shipped the same day⁴. Check its release notes before assuming it carries this fix, and note that 25.0's security support ends on 4 December 2026⁴.

For CI, the runner image or the Docker-in-Docker service version is what matters, not your laptop. Search your pipeline config for pinned Engine versions:

$ grep -rnE "docker:[0-9]+\.[0-9]+|docker-version|dind" .github/ .gitlab-ci.yml 2>/dev/null

If you cannot upgrade today

The advisory suggests two mitigations²:

1. Pin the registry hostname to its expected address, with a trusted DNS configuration or a hosts-file entry on the Docker host.
2. Restrict outbound network access from the daemon, so registry connections can only reach trusted registry endpoints.

A hosts-file pin is a single line. Use the registry's real address, which you have checked out-of-band:

203.0.113.10  registry.example.com

A pin breaks when the registry changes address, which happens often with registries behind a CDN or a cloud load balancer. Treat it as a bridge to the upgrade, not a fix. The advisory itself says that at least one of these workarounds does not prevent credential disclosure and should not be considered complete².

Before pinning anything, check that the registry's name does not already resolve to a loopback address from that host. This only catches the problem if it is happening when you run it, but it costs nothing:

#!/usr/bin/env bashset -euo pipefailhost="${1:?usage: $0 registry-hostname}"answers=$(getent ahosts "$host" | awk '{print $1}' | sort -u)echo "$answers"if grep -qE '^(127\.|::1$)' <<<"$answers"; then  echo "WARNING: $host resolves to a loopback address" >&2  exit 1fi

$ bash check-registry-dns.sh registry.example.com

The BuildKit fixes: crashes and cache poisoning on shared builders

The other ten fixes are in BuildKit, which 29.8.2 updates to v0.33.1¹. They matter most where builds take input you do not control, such as pull requests from forks or a build service shared between teams.

All ten are described in the Engine 29 release notes, each with its GitHub advisory¹.

Builders the Engine upgrade does not touch

Upgrading the Engine updates the BuildKit bundled with the daemon. Check each builder's BuildKit version and confirm it is at least v0.33.1, the version that carries the fixes¹:

$ docker buildx ls$ docker buildx inspect --bootstrap | grep -i "buildkit version"

Clear cache that was built before the upgrade

Upgrading stops new cache poisoning. As far as the release notes say, it does nothing about entries that were poisoned earlier. On builders shared across projects, or ones that have built untrusted input, prune the build cache once the upgrade is done:

$ docker builder prune --all --force

The next builds run cold and take longer. That is the cost of knowing the cache is clean.

Swarm and containerd

CVE-2026-92542 affects encrypted overlay networks in Swarm. An unprivileged user on one node could inject forged Ethernet frames into those networks on peer nodes¹. If you do not run Swarm, it does not apply to you.

CVE-2026-53493 is an unbounded CPU and memory problem when pulling a crafted OCI image index¹. Its advisory lives in the containerd repository (GHSA-pg57-6jwg-q645), and 29.8.2 updates its static containerd binaries to v2.3.6¹. Hosts that run containerd without Docker, such as most Kubernetes nodes, will not get a fix from a Docker upgrade. Check containerd's advisory for the fixed versions.

What to do this week

• Every host that pulls from a private registry reports 29.8.2 from docker version --format '{{.Server.Version}}'.
• CI runner images and Docker-in-Docker services are upgraded too, not just the hosts you log in to.
• Where an upgrade has to wait, the registry hostname is pinned or the daemon's egress is restricted, and the delay has an end date.
• Every buildx builder reports BuildKit v0.33.1 or later.
• Shared builders have had their build cache pruned after the upgrade.
• containerd-only hosts are checked against containerd's own advisory.

If you do one thing, do the first. The other items reduce exposure; only the upgrade closes the bug.