{"id":"CVE-2026-115539","published":"2026-11-10T20:18:03.897","lastModified":"2026-11-10T20:18:03.897","description":"SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when built with grpc-go 1.39 or later. During a short window after a leader change, two proxy hops through managers with inconsistent views of the leader can allow an attacker possessing a valid worker node TLS certificate and private key to obtain a manager node certificate for the attacker's own key, escalating privileges from worker to manager. Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-441"],"vendors":[],"products":[],"references":[{"url":"https://github.com/moby/swarmkit/security/advisories/GHSA-628g-hv7f-pgjc","tags":[]}],"exploitRefs":[{"url":"https://github.com/moby/swarmkit/security/advisories/GHSA-628g-hv7f-pgjc","tags":[]}],"hasPoc":true,"ai":null}