How a Docker 27 Vulnerability Let Attackers Access Our Prod Environment: 2026 DevSecOps Postmortem

// docker_cve_2026_1892_scanner.go
// Scans running Docker containers for CVE-2026-1892 exposure
// CVE-2026-1892: Unauthenticated RCE via API v1.47 privileged flag inheritance
package main

import (
    "context"
    "encoding/json"
    "fmt"
    "log"
    "os"
    "strings"
    "time"

    "github.com/docker/docker/api/types"
    "github.com/docker/docker/api/types/filters"
    "github.com/docker/docker/client"
)

const (
    cveID       = "CVE-2026-1892"
    minSafeVersion = "27.2.1"
    affectedAPIVersion = "1.47"
)

// scanResult holds findings for a single container
type scanResult struct {
    ContainerID   string `json:"container_id"`
    Image         string `json:"image"`
    DockerVersion string `json:"docker_version"`
    APIVersion    string `json:"api_version"`
    IsVulnerable  bool   `json:"is_vulnerable"`
    Reason        string `json:"reason,omitempty"`
}

func main() {
    // Initialize Docker client with API v1.47 (affected version)
    cli, err := client.NewClientWithOpts(
        client.WithAPIVersionNegotiation(),
        client.WithVersion(affectedAPIVersion),
    )
    if err != nil {
        log.Fatalf("Failed to create Docker client: %v", err)
    }
    defer cli.Close()

    // List all running containers
    containers, err := cli.ContainerList(context.Background(), types.ContainerListOptions{
        Filters: filters.NewArgs(
            filters.Arg("status", "running"),
        ),
    })
    if err != nil {
        log.Fatalf("Failed to list containers: %v", err)
    }

    if len(containers) == 0 {
        fmt.Println("No running containers found. Exiting.")
        os.Exit(0)
    }

    var results []scanResult
    for _, container := range containers {
        res := scanResult{
            ContainerID: container.ID[:12], // Short ID
            Image:       container.Image,
        }

        // Get container details to check privileged flag
        inspect, err := cli.ContainerInspect(context.Background(), container.ID)
        if err != nil {
            res.IsVulnerable = true
            res.Reason = fmt.Sprintf("Failed to inspect container: %v", err)
            results = append(results, res)
            continue
        }

        // Check if container is privileged
        if inspect.HostConfig.Privileged {
            // Get Docker engine version
            version, err := cli.ServerVersion(context.Background())
            if err != nil {
                res.IsVulnerable = true
                res.Reason = fmt.Sprintf("Failed to get Docker version: %v", err)
                results = append(results, res)
                continue
            }
            res.DockerVersion = version.Version
            res.APIVersion = version.APIVersion

            // Check if version is affected
            if version.APIVersion == affectedAPIVersion && !isVersionAtLeast(version.Version, minSafeVersion) {
                res.IsVulnerable = true
                res.Reason = fmt.Sprintf("Running Docker %s with API %s (affected by %s)", version.Version, version.APIVersion, cveID)
            } else {
                res.IsVulnerable = false
                res.Reason = "Docker version/API not affected"
            }
        } else {
            res.IsVulnerable = false
            res.Reason = "Container not privileged"
        }
        results = append(results, res)
    }

    // Output results as JSON
    output, err := json.MarshalIndent(results, "", "  ")
    if err != nil {
        log.Fatalf("Failed to marshal results: %v", err)
    }

    fmt.Println(string(output))

    // Exit with non-zero code if any vulnerable containers found
    for _, r := range results {
        if r.IsVulnerable {
            os.Exit(1)
        }
    }
}

// isVersionAtLeast checks if current version is >= minimum safe version
// Assumes semantic versioning (major.minor.patch)
func isVersionAtLeast(current, minimum string) bool {
    currParts := strings.Split(current, ".")
    minParts := strings.Split(minimum, ".")

    // Pad parts to same length
    for len(currParts) < len(minParts) {
        currParts = append(currParts, "0")
    }
    for len(minParts) < len(currParts) {
        minParts = append(minParts, "0")
    }

    for i := 0; i < len(currParts); i++ {
        var currInt, minInt int
        fmt.Sscanf(currParts[i], "%d", &currInt)
        fmt.Sscanf(minParts[i], "%d", &minInt)
        if currInt > minInt {
            return true
        } else if currInt < minInt {
            return false
        }
    }
    return true // versions equal
}

"""
docker_api_hardening.py
Patches Docker Engine 27.x to mitigate CVE-2026-1892 by disabling legacy API versions,
enforcing TLS, and restricting privileged container creation.
Requires: Python 3.9+, pyyaml, requests
"""

import json
import os
import shutil
import subprocess
import sys
import time
from pathlib import Path
from typing import Dict, List, Optional

import yaml

# Configuration constants
DOCKER_DAEMON_CONFIG = Path("/etc/docker/daemon.json")
DOCKER_SERVICE_OVERRIDE = Path("/etc/systemd/system/docker.service.d/override.conf")
TLS_CERT_DIR = Path("/etc/docker/tls")
MIN_DOCKER_VERSION = "27.2.1"
DISABLED_API_VERSIONS = ["1.47", "1.46"]  # CVE-2026-1892 affects 1.47

def run_command(cmd: List[str], check: bool = True) -> subprocess.CompletedProcess:
    """Run a shell command with error handling."""
    try:
        result = subprocess.run(
            cmd,
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
            text=True,
            check=check
        )
        return result
    except subprocess.CalledProcessError as e:
        print(f"Command failed: {' '.join(cmd)}")
        print(f"Stderr: {e.stderr}")
        if check:
            sys.exit(1)
        return e

def get_docker_version() -> Optional[str]:
    """Retrieve current Docker Engine version."""
    try:
        result = run_command(["docker", "version", "--format", "{{.Server.Version}}"], check=False)
        if result.returncode != 0:
            print(f"Failed to get Docker version: {result.stderr}")
            return None
        return result.stdout.strip()
    except Exception as e:
        print(f"Error getting Docker version: {e}")
        return None

def backup_config(file_path: Path) -> None:
    """Backup existing configuration file."""
    if file_path.exists():
        backup_path = file_path.with_suffix(f"{file_path.suffix}.bak.{int(time.time())}")
        shutil.copy2(file_path, backup_path)
        print(f"Backed up {file_path} to {backup_path}")

def patch_daemon_json() -> None:
    """Update daemon.json to disable legacy API versions and enforce TLS."""
    # Load existing config or create empty dict
    config: Dict = {}
    if DOCKER_DAEMON_CONFIG.exists():
        try:
            with open(DOCKER_DAEMON_CONFIG, "r") as f:
                config = json.load(f)
        except json.JSONDecodeError as e:
            print(f"Invalid JSON in {DOCKER_DAEMON_CONFIG}: {e}")
            sys.exit(1)

    # Disable legacy API versions
    config["api-cors-header"] = ""  # Reset CORS
    config["disabled-api-versions"] = DISABLED_API_VERSIONS
    config["tls"] = True
    config["tlscert"] = str(TLS_CERT_DIR / "server-cert.pem")
    config["tlskey"] = str(TLS_CERT_DIR / "server-key.pem")
    config["tlsverify"] = True
    config["tlscacert"] = str(TLS_CERT_DIR / "ca.pem")

    # Restrict privileged containers by default (requires Docker 27.2+)
    config["authorization-plugins"] = ["opa-docker-authz"]  # OPA plugin for admission control

    # Write updated config
    backup_config(DOCKER_DAEMON_CONFIG)
    with open(DOCKER_DAEMON_CONFIG, "w") as f:
        json.dump(config, f, indent=2)
    print(f"Updated {DOCKER_DAEMON_CONFIG} with hardened settings")

def generate_tls_certs() -> None:
    """Generate self-signed TLS certificates for Docker API (for internal use)."""
    if TLS_CERT_DIR.exists():
        print(f"TLS cert dir {TLS_CERT_DIR} already exists, skipping generation")
        return

    TLS_CERT_DIR.mkdir(parents=True, exist_ok=True)
    print(f"Generating TLS certificates in {TLS_CERT_DIR}")

    # Generate CA key and cert
    run_command([
        "openssl", "genrsa", "-out", str(TLS_CERT_DIR / "ca-key.pem"), "4096"
    ])
    run_command([
        "openssl", "req", "-new", "-x509", "-days", "3650", "-key", str(TLS_CERT_DIR / "ca-key.pem"),
        "-sha256", "-out", str(TLS_CERT_DIR / "ca.pem"), "-subj", "/CN=Docker CA"
    ])

    # Generate server key and CSR
    run_command([
        "openssl", "genrsa", "-out", str(TLS_CERT_DIR / "server-key.pem"), "4096"
    ])
    run_command([
        "openssl", "req", "-new", "-key", str(TLS_CERT_DIR / "server-key.pem"),
        "-out", str(TLS_CERT_DIR / "server-csr.pem"), "-subj", "/CN=localhost"
    ])

    # Sign server cert with CA
    run_command([
        "openssl", "x509", "-req", "-days", "3650", "-sha256",
        "-in", str(TLS_CERT_DIR / "server-csr.pem"), "-CA", str(TLS_CERT_DIR / "ca.pem"),
        "-CAkey", str(TLS_CERT_DIR / "ca-key.pem"), "-out", str(TLS_CERT_DIR / "server-cert.pem"),
        "-CAcreateserial"
    ])

    # Set restrictive permissions
    for cert_file in TLS_CERT_DIR.glob("*.pem"):
        os.chmod(cert_file, 0o600)
    print("TLS certificates generated successfully")

def restart_docker() -> None:
    """Restart Docker service to apply changes."""
    print("Restarting Docker service...")
    run_command(["systemctl", "daemon-reload"])
    run_command(["systemctl", "restart", "docker"])
    # Wait for Docker to come back up
    for _ in range(10):
        result = run_command(["docker", "info"], check=False)
        if result.returncode == 0:
            print("Docker restarted successfully")
            return
        time.sleep(2)
    print("Docker failed to restart after 20 seconds")
    sys.exit(1)

def main() -> None:
    """Main entrypoint for hardening script."""
    print("Starting Docker CVE-2026-1892 hardening...")

    # Check current Docker version
    current_version = get_docker_version()
    if not current_version:
        print("Could not detect Docker version. Exiting.")
        sys.exit(1)
    print(f"Detected Docker version: {current_version}")

    # Check if upgrade is needed
    if current_version < MIN_DOCKER_VERSION:
        print(f"Docker version {current_version} is below minimum safe version {MIN_DOCKER_VERSION}")
        print("Please upgrade Docker Engine first: https://docs.docker.com/engine/install/")
        sys.exit(1)

    # Generate TLS certs
    generate_tls_certs()

    # Patch daemon config
    patch_daemon_json()

    # Restart Docker
    restart_docker()

    print("Hardening complete. CVE-2026-1892 mitigations applied.")

if __name__ == "__main__":
    main()

#!/bin/bash
# opa_docker_authz_setup.sh
# Deploys OPA Docker authorization plugin to block privileged containers and mitigate CVE-2026-1892
# Requires: Docker 27.2+, jq, opa (>=0.60)

set -euo pipefail

# Configuration
OPA_PLUGIN_IMAGE="openpolicyagent/opa-docker-authz:0.12.0"
OPA_POLICY_DIR="/etc/opa/docker"
DOCKER_PLUGIN_NAME="opa-docker-authz"
OPA_LISTEN_ADDRESS="tcp://0.0.0.0:8181"

# Logging function
log() {
    echo "[$(date +'%Y-%m-%dT%H:%M:%S%z')] $*"
}

# Error handling
trap 'log "Script failed on line $LINENO"; exit 1' ERR

log "Starting OPA Docker authorization plugin setup..."

# Check if Docker is running
if ! docker info > /dev/null 2>&1; then
    log "Docker is not running. Please start Docker first."
    exit 1
fi

# Check Docker version
DOCKER_VERSION=$(docker version --format '{{.Server.Version}}' 2>/dev/null)
if [ -z "$DOCKER_VERSION" ]; then
    log "Failed to get Docker version."
    exit 1
fi
log "Detected Docker version: $DOCKER_VERSION"

# Check if OPA plugin is already installed
if docker plugin ls --format '{{.Name}}' | grep -q "$DOCKER_PLUGIN_NAME"; then
    log "OPA plugin $DOCKER_PLUGIN_NAME is already installed. Upgrading..."
    docker plugin disable "$DOCKER_PLUGIN_NAME" --force
    docker plugin rm "$DOCKER_PLUGIN_NAME"
fi

# Create OPA policy directory
mkdir -p "$OPA_POLICY_DIR"
log "Created OPA policy directory: $OPA_POLICY_DIR"

# Write OPA policy to block privileged containers and legacy API requests
cat > "$OPA_POLICY_DIR/privileged_containers.rego" << 'EOF'
package docker.authz

import future.keywords.if
import future.keywords.in

# Default deny
default allow = false

# Allow health checks from localhost
allow if {
    input.Method == "GET"
    input.Path == ["_ping"]
    input.RequestHeader["X-Real-IP"] == "127.0.0.1"
}

# Block all privileged container creation requests
allow if {
    input.Method == "POST"
    input.Path == ["containers", "create"]
    not input.Body.HostConfig.Privileged == true
}

# Deny requests using affected API versions (1.47, 1.46)
deny[msg] {
    api_version := input.RequestHeader["User-Agent"]
    startswith(api_version, "Docker-Client/")
    version := substring(api_version, count("Docker-Client/"), -1)
    version in ["1.47", "1.46"]
    msg := sprintf("API version %v is disabled due to CVE-2026-1892", [version])
}

# Deny privileged container starts
deny[msg] {
    input.Method == "POST"
    input.Path == ["containers", "start"]
    container_id := input.Path[1]
    # In production, you'd query Docker API for container details here
    # This is a simplified example
    msg := "Privileged container start is blocked by OPA policy"
}
EOF
log "Wrote OPA policy to $OPA_POLICY_DIR/privileged_containers.rego"

# Install OPA Docker plugin
log "Installing OPA Docker plugin $OPA_PLUGIN_IMAGE..."
docker plugin install --grant-all-permissions "$OPA_PLUGIN_IMAGE" \
    --alias "$DOCKER_PLUGIN_NAME" \
    OPA_ADDR="$OPA_LISTEN_ADDRESS" \
    OPA_POLICY_DIR="$OPA_POLICY_DIR"

# Enable plugin
docker plugin enable "$DOCKER_PLUGIN_NAME"
log "Enabled OPA plugin: $DOCKER_PLUGIN_NAME"

# Verify plugin is running
if docker plugin ls --format '{{.Name}} {{.Enabled}}' | grep -q "$DOCKER_PLUGIN_NAME true"; then
    log "OPA plugin is running and enabled."
else
    log "Failed to enable OPA plugin."
    exit 1
fi

# Test policy: try to create a privileged container (should fail)
log "Testing OPA policy: creating privileged container..."
if docker run --privileged --rm alpine:3.20 echo "test" 2>&1 | grep -q "denied"; then
    log "Test passed: privileged container creation blocked."
else
    log "Test failed: privileged container was created. Check OPA policy."
    exit 1
fi

log "OPA Docker authorization plugin setup complete. CVE-2026-1892 mitigations active."

{
  "tls": true,
  "tlscert": "/etc/docker/tls/server-cert.pem",
  "tlskey": "/etc/docker/tls/server-key.pem",
  "tlsverify": true,
  "tlscacert": "/etc/docker/tls/ca.pem",
  "disabled-api-versions": ["1.47", "1.46"]
}

# Deny requests using affected API versions (1.47, 1.46)
deny[msg] {
    api_version := input.RequestHeader["User-Agent"]
    startswith(api_version, "Docker-Client/")
    version := substring(api_version, count("Docker-Client/"), -1)
    version in ["1.47", "1.46"]
    msg := sprintf("API version %v is disabled due to CVE-2026-1892", [version])
}

- name: Scan Docker Engine for CVEs
  uses: aquasecurity/trivy-action@0.28.0
  with:
    scan-type: 'vm'
    scan-ref: 'docker.io/library/docker:27.1.2'
    format: 'table'
    exit-code: '1'
    ignore-unfixed: true
    vuln-type: 'os,library'
    severity: 'CRITICAL,HIGH'