CVE-2026-80238: Dell SCG 5.0 Privilege Escalation Flaw

CVE-2026-80238 Overview

CVE-2026-80238 affects Dell Secure Connect Gateway (SCG) 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00. The vulnerability stems from Execution with Unnecessary Privileges [CWE-250] tied to an exposed Docker socket on the SCG host. A low-privileged operator with SSH access can obtain root-level control without a password. An attacker who compromises a service inside the orchestrator container can also access the same socket and escape to the host. Dell has published advisory DSA-2026-382 and recommends upgrading immediately.

Critical Impact
Local attackers can bypass protection mechanisms and gain root on the SCG host through the exposed Docker socket, breaking container isolation.

Affected Products

Dell Secure Connect Gateway 5.0 Appliance versions prior to 5.36.00.16
Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00
Dell Secure Connect Gateway Virtual Edition

Discovery Timeline

2026-09-07 - CVE-2026-80238 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-80238

Vulnerability Analysis

The flaw resides in how the SCG host exposes the Docker Unix socket to accounts that should not hold privileged container control. Any process able to reach /var/run/docker.sock can instruct the Docker daemon, which runs as root, to launch containers with arbitrary mounts and privileges. This turns socket access into a direct path to host root. A low-privileged SSH operator can create a privileged container that bind-mounts the host filesystem and executes commands as root outside the container. The same primitive is reachable from within the orchestrator container if any hosted service is compromised.

Root Cause

The root cause is Execution with Unnecessary Privileges [CWE-250]. The Docker socket is exposed to contexts that should operate under least privilege, and the daemon does not distinguish between administrative and operator callers. Container isolation collapses because the orchestrator container mounts the socket from the host.

Attack Vector

Exploitation requires local access, either through SSH as a low-privileged operator or through a compromised service running inside the orchestrator container. No authentication to the Docker daemon is required once the socket is reachable. The attacker uses standard Docker client interactions with the socket to spawn a privileged container that mounts the host root filesystem and executes commands with root privileges, achieving container escape and full host compromise.

No verified public proof-of-concept code is available. See the Dell Security Update DSA-2026-382 for vendor technical details.

Detection Methods for CVE-2026-80238

Indicators of Compromise

Unexpected Docker API calls from non-administrative user contexts on the SCG host
Creation of containers with --privileged, --pid=host, or host filesystem bind mounts such as /:/host
SSH sessions from operator accounts followed by invocations of the docker client or direct writes to /var/run/docker.sock
New root-owned files or scheduled tasks written from within short-lived container processes

Detection Strategies

Audit Docker daemon logs for container create and exec events initiated by non-root or operator accounts
Monitor Linux auditd for connect() syscalls targeting /var/run/docker.sock from unexpected UIDs
Baseline the set of accounts that legitimately interact with the Docker socket and alert on deviations

Monitoring Recommendations

Forward SCG host authentication, sudo, and Docker events to a centralized SIEM or data lake for correlation
Alert on any privileged container launch on SCG hosts and on host-path mounts referencing /, /etc, or /root
Track SSH logins by low-privileged operator accounts and correlate with subsequent container activity

How to Mitigate CVE-2026-80238

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later and SCG 5.0 Application to 5.36.00.00 or later
Restrict SSH access to the SCG host to administrative accounts only
Remove operator accounts from any group that grants read or write access to /var/run/docker.sock
Review recent Docker daemon activity for signs of privileged container abuse

Patch Information

Dell has released fixed builds referenced in advisory DSA-2026-382. Customers should apply the Dell Security Update DSA-2026-382 at the earliest opportunity. Upgrade paths are documented in the Dell knowledge base article.

Workarounds

Limit SSH access to the SCG host through network ACLs and jump-host enforcement until patching is complete
Enforce strict filesystem permissions on /var/run/docker.sock so only the root user and required system accounts can access it
Avoid mounting the host Docker socket into orchestrator or application containers where feasible
Monitor and log all interactive shell activity on the SCG appliance during the mitigation window

bash

# Configuration example: restrict Docker socket access on the SCG host
sudo chown root:root /var/run/docker.sock
sudo chmod 0600 /var/run/docker.sock

# Remove operator accounts from the docker group
sudo gpasswd -d <operator_user> docker

# Verify no non-root accounts retain socket access
sudo getfacl /var/run/docker.sock