CVE-2026-112346: Docker Publish Port Mapping Without Bind Addresscve-2026-112346-docker-publish-port-mapping-without-bind-address
A Docker port publish flag "-p"/"--publish" is built from a two-part host:container mapping with no bind address, so Docker publishes the container port on every host interface (0.0.0.0). Any server inside the container (e.g. an agent/exec API) becomes reachable from every network that can reach the host, and Docker's published-port DNAT rules usually bypass
