CVE-2026-115539
Cluster-API proxy overwrites forwarded client identity with its own
SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when built with grpc-go 1.39 or later. During a short window after a leader change, two proxy hops through managers with inconsistent views of the leader can allow an attacker possessing a valid worker node TLS certificate and private key to obtain a manager node certificate for the attacker's own key, escalating privileges from worker to manager. Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted.
| CWE | CWE-441 |
| Vendor | moby |
| Product | swarmkit |
| Published | Nov 10, 2026 |
Get instant alerts for moby swarmkit
Be the first to know when new unknown vulnerabilities affecting moby swarmkit are published — delivered to Slack, Telegram or Discord.