Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Because the transport re-dials the hostname rather than the CIDR-matching address, a DNS answer set of one loopback IP plus a non-loopback attacker IP disables certificate verification and enables HTTP fallback for the registry connection.
Fix
Microsoft's update · Important
- Release Notes — azl3 cert-manager 1.12.15-14 on Azure Linux 3.0 · build 1.12.15-15
- Release Notes — azl3 docker-buildx 0.14.0-17 on Azure Linux 3.0 · build 0.14.0-19
- Release Notes — azl3 docker-cli 25.0.7-5 on Azure Linux 3.0 · build 25.0.7-6
- Release Notes — azl3 docker-compose 2.27.0-14 on Azure Linux 3.0 · build 2.27.0-16
From the 2026-Oct release note of Microsoft's Security Update Guide, revised 2026-10-30.
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.6NVD modified 2026-10-08 20:46
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.