�� Docker fixed a flaw letting attackers bypass AuthZ plugins with a padded API request (>1MB).

The plugin sees no body and allows it, while Docker executes it—creating a privileged container with host access and exposed credentials.

�� Learn how this leads to full host compromise → https://thehackernews.com/2026/04/docker-cve-2026-34040-lets-attackers.html