Docker Bypasses UFW Firewall Exposing PostgreSQL and Redis Ports to Rapid Malware Infections
A typical migration to a fresh VPS begins with basic hardening on Ubuntu or Debian using UFW with default deny incoming and only ports 22, 80, and 443 allowed. After confirming UFW status shows no unexpected listeners, Docker is installed and a compose file launches backend services including PostgreSQL and Redis with explicit port mappings such as "5432:5432" for convenient remote access via tools like DBeaver.
Within days, abuse reports arrive from the hosting provider or monitoring alerts trigger as CPU usage spikes from processes like kdevtmpfsi or kinsing, while database tables are replaced by ransom notes demanding Bitcoin. The root cause lies in how Docker manipulates Netfilter tables, bypassing UFW entirely.
Netfilter Bypass Mechanism
Docker enables IP forwarding and creates bridge interfaces such as docker0 and br-xxxx for each compose stack. It inserts DNAT rules into the nat PREROUTING chain that rewrite destination addresses from the host's public IP to internal container IPs like 172.18.0.2 before routing decisions occur. Traffic then enters the FORWARD chain where Docker's DOCKER-FORWARD and DOCKER chains appear above UFW's ufw-before-forward rules, granting ACCEPT for the mapped ports.
Testing with netcat from an external machine confirms both 5432 and 6379 respond despite UFW verbose status showing only SSH and web ports allowed. The ss command reveals docker-proxy listening on 0.0.0.0 and [::] for these ports.
IPv6 Exposure Risks
Starting with Docker 27.0, ip6tables management activates by default. Administrators who configure protections only in IPv4 tables or set IPV6=no in ufw defaults leave IPv6 sockets open. Hetzner and similar providers assign public /64 prefixes, allowing scanners to reach [::]:5432 even when IPv4 is blocked.
Bot Activity Timeline and Techniques
Cloud IP ranges are continuously scanned by masscan and zmap for database ports. In one documented case on a Hetzner CPX21 instance running Qdrant, Redis, and PostgreSQL, the first REPLICAOF connection arrived 1 minute 52 seconds after container startup.
- For Redis without authentication, bots issue FLUSHALL then attempt CONFIG SET to write cron jobs or load malicious modules via replication.
- Older images remain vulnerable to CVE-2022-0543 Lua escapes on Debian-based builds.
- PostgreSQL instances with weak default credentials such as postgres:password123 are directly accessible for data exfiltration or ransomware deployment.
Similar incidents affected Spree Commerce starter templates where maintainers noted the configuration was intended only for local development.
Related articles
WordPress 7.1.4 Addresses RCE in Update Process and Multiple Stored XSS Vulnerabilities
The WordPress development team released version 7.1.4 on October 28, 2026, as a security update to resolve several vulnerabilities. The most severe issue allows remote code execution during the software upgrade process. Multiple stored cross-site scripting flaws were also fixed, including those triggered by specially crafted block markup and manipulated privacy data deletion requests. No CVE identifiers were disclosed in the advisory. Site administrators are strongly urged to apply the update immediately to prevent potential exploitation. The announcement was reported by Security NEXT on November 2, 2026.
CISA Adds Two Ivanti Connect Secure Flaws to KEV Catalog After Confirmed Exploitation
US authorities have issued an alert after confirmed exploitation of two vulnerabilities in Ivanti Connect Secure (ICS). The flaws, tracked as CVE-2026-111357 and CVE-2026-118527, were added to CISA’s Known Exploited Vulnerabilities Catalog on October 30, 2026. Attacks combining three vulnerabilities have also been observed in the wild. CVE-2026-111357 allows local authenticated attackers to escalate privileges due to missing authentication in a critical function. CVE-2026-118527 enables remote upload of arbitrary files to disk through predictable identifiers, even though authentication is required. The addition of CVE-2026-111357 was briefly withdrawn before being reinstated, highlighting administrative confusion around the listing.
Enodia: Open-Source Go Tool Automates Service Inventory, EOL Tracking and CVE Correlation
A DevOps engineer has released enodia, a single-binary Go CLI that discovers real versions of services across large heterogeneous environments and correlates them with end-of-life calendars and vulnerability databases. The tool was built after manual Ansible-based inventories and existing solutions such as endoflife.date, nvchecker, Renovate and Uptime Kuma proved insufficient for covering both infrastructure and application services while also providing actionable lifecycle, patch and branch status. Enodia uses product-specific probes for 123 technologies including PostgreSQL, MySQL, MariaDB, Jira, Confluence, Bitbucket, VMware vCenter, ESXi, pfSense and multiple Linux distributions, falling back to a generic URL-plus-regex probe when needed. Data collection is deliberately separated from evaluation so that inventory.jsonl files can be generated inside air-gapped networks and later analysed where CVE feeds are available. The project also contributed dozens of missing products and corrected EOL dates to the endoflife.date project and integrates both NVD and Russia’s FSTEC BDU vulnerability databases. Special handling was added for MySQL/MariaDB connection-error counters, version-string masquerading, and vendor-specific update nomenclature to avoid false reports.
Telegram Voice Call Flaw Allows Remote Code Execution on Android Devices
Security researchers disclosed a vulnerability in Telegram for Android that enables remote code execution on a victim's device simply by answering a voice call. The attacker requires only a standard account, and the flaw was present in versions 8.6.2 through 12.10.3 released between March 2022 and September 2026. Telegram addressed the issue in version 12.10.4, released at the end of September 2026. The root cause lies in improper handling of the MediaState message exchanged during calls, specifically when processing rotation values and missing video state fields, leading to out-of-bounds memory reads. The same underlying fix was deployed earlier to shared call libraries, iOS, and desktop clients, but reached Android later. Researchers confirmed the impact only on private calls running on ARM64 Android devices, with no evidence of exploitation in the wild or public CVE assignment as of October 29, 2026.