A path-handling flaw in Docker that allows an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. NVD scores it 5.3 (Medium, CVSS 3.1) and records it as analysed.

The score is the lowest in its KEV batch and the exploitation requirement is the highest — an authenticated user plus particular remote-repository configuration — but CISA added it to the Known Exploited Vulnerabilities Catalog on 27 August 2026 on evidence of active exploitation. Writing outside a cache path is a foothold rather than a payload, and on a build host or CI runner that foothold reaches whatever credentials and source the pipeline can see, which is why a medium score can still sit in a KEV batch alongside a critical one.

• NVD record — CVE-2026-66384
• CISA KEV alert, 27 August 2026