The 29.8.2 release closes 14 daemon and BuildKit vulnerabilities, including CVE-2026-92543, which lets a malicious DNS response skip TLS verification or fall back to HTTP during an image pull. Update before your next CI/CD build and pin digests to block image substitution.

CVE-2026-66384, a path traversal in Artifactory’s Docker cache, lets an authenticated user write outside the intended directory and joined CISA’s KEV catalog on 27 August 2026. Upgrade your self-hosted instance to 7.146.35 or 7.161.16 and restrict remote repository creation.