Docker/Moby AuthZ Plugin Authorization Bypass

This repository is a Python-based full lab PoC for CVE-2026-34040, targeting Docker/Moby AuthZ plugin bypass behavior when a Docker API request body exceeds 1 MB. The repository is small and focused: one executable script (poc.py), a standard-library-only requirements file, and several Markdown documents covering setup, demo flow, impact modes, troubleshooting, and publication notes. The main exploit logic is in poc.py. It manually crafts raw HTTP requests over the local UNIX socket /var/run/docker.sock rather than using the Docker SDK. The key capability is sending a container creation request with oversized JSON label padding ("padding" = "A" * (1024*1024+1)) so that an AuthZ plugin may fail to inspect the body while the Docker daemon still processes the original request. The script compares a normal request against an oversized one in check mode to determine whether the bypass is observable, expecting small requests to be blocked (HTTP 403) and oversized requests to reach daemon processing (HTTP 201 or possibly HTTP 404 if the image is missing). Beyond detection, the PoC includes multiple post-bypass impact modes. These include reading host files by creating a privileged container with the host root mounted read-only, writing a proof marker file on the host via chroot, executing user-supplied host commands in a lab, creating a long-lived privileged container for manual docker exec and chroot interaction, and a local-only reverse shell mode restricted to 127.0.0.1/localhost. The README and docs explicitly describe that the vulnerability itself is an authorization bypass, while file read and command execution are downstream impacts enabled by privileged container creation plus host bind mounts. Repository structure: README.md explains the vulnerability model, usage, and safety notes; docs/lab-setup.md lists prerequisites such as vulnerable Docker/Moby, AuthZ plugin, docker.sock access, and local alpine image; docs/impact-modes.md and docs/demo-script.md describe each demonstration path; docs/troubleshooting.md covers common failures like missing image or socket permissions. Overall, this is a real exploit PoC for local lab use, not merely a detector, and it is operational because it contains working payload paths for host file access and host command execution.