high severity · published 2026-11-10
After firewalld reloads or starts, the overlay driver does not restore the iptables rules that encrypt overlay traffic, so outgoing VXLAN datagrams are sent unencrypted and incoming cleartext VXLAN traffic is accepted. An attacker on the network can read or spoof traffic between overlay network nodes, and the condition is silent because dockerd does not log it.
Fixed in: 29.9.3
CVE: CVE-2026-115538
Source: NVD
You are affected if the installed version is older than 29.9.3. Check the version you have and update to 29.9.3 or later. The fixed version is verified against a vendor or advisory source.
FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 2399 and your operating system.