docker 29.3.1

29.3.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

• docker/cli, 29.3.1 milestone
• moby/moby, 29.3.1 milestone

Security

This release includes fixes for multiple security vulnerabilities affecting Docker Engine and related components.

• CVE-2026-34040 Fix an authorization bypass in AuthZ plugins that could allow authorization plugins to be bypassed under specific conditions.
  GHSA-x744-4wpc-v9h2

• CVE-2026-33997 Fix a flaw in docker plugin install where privilege validation could be partially bypassed, potentially leading to unauthorized privilege escalation.
  GHSA-pxq6-2prw-chj9

• CVE-2026-33748 Fix insufficient validation of Git URL #ref:subdir fragments in BuildKit, which could allow access to files outside the intended repository scope.
  GHSA-4vrq-3vrq-g6gg

• CVE-2026-33747 Fix a vulnerability in BuildKit where an untrusted frontend could cause files to be written outside the BuildKit state directory.
  GHSA-3c29-8rgm-jvjj

Bug fixes and enhancements

• Fix a daemon crash during docker build if .dockerignore contained an invalid pattern. moby/moby#52214
• Fix a panic when the containerd client uses a closed stream. moby/moby#52211

Packaging updates

• Update containerd (static binaries) to v2.2.2. moby/moby#52213
• Update Go runtime to 1.25.8. moby/moby#52210, docker/cli#6883

Go SDK

• Add missing build-tag, which could cause cannot range over 10 (untyped int constant) when importing the cli/command package. docker/cli#6884