CVE-2017-20198: d2iq, Inc Dc/os Marathon

Critical severity, CVSS 9.3. EPSS: 1.1% chance of exploitation in the next 30 days.

The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations, attackers can deploy a container that mounts the host's root filesystem (/) with read/write privileges. When using a malicious Docker image, the attacker can write to /etc/cron.d/ on the host, achieving arbitrary code execution with root privileges. This impacts any system where the Docker daemon honors Marathon container configurations without policy enforcement.

Affected products

• d2iq, Inc Dc/os Marathon: before 1.9.0 (fixed in 1.9.0)

Published 2025-07-23. Last modified 2026-06-17.