Docker Desktop vulnerabilities

• docker desktop Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall CVE-2026-112917 9.2 CriticalNovember 3, 2026
• docker desktop Docker Desktop logs can expose stored third-party credentials CVE-2026-114409 5.7 MediumOctober 27, 2026
• docker desktop Docker Desktop for Windows installer failed to verify external packages CVE-2026-106581 8.2 HighOctober 9, 2026
• moby go-archive, docker cli, compose +3 more +5 more Tar extraction in moby/go-archive can write outside the destination directory via link following CVE-2026-17106 Public exploitFix available 7.1 HighAugust 18, 2026
• docker desktop Unbounded recursion in grpcfuse kernel module allows container to crash Docker Desktop VM CVE-2026-8936 8.2 HighJune 2, 2026
• docker desktop Docker Model Runner container-to-host code execution via MLX-LM model_file importlib loading CVE-2026-5843 Public exploit 8.8 HighMay 22, 2026
• docker desktop Docker Model Runner container-to-host code execution via unsandboxed trust_remote_code in Python inference backends CVE-2026-5817 Public exploit 8.8 HighMay 22, 2026
• docker desktop Docker Desktop Enhanced Container Isolation bypass via --use-api-socket CLI flag CVE-2026-6406 8.8 HighMay 22, 2026
• docker desktop Out of bounds read vulnerability in grpcfuse kernel module CVE-2026-2664 6.8 MediumFebruary 24, 2026
• docker desktop Docker Desktop for Windows Incorrect Permission Assignment Privilege Escalation Vulnerabilities CVE-2025-14740 6.7 MediumFebruary 4, 2026
• docker desktop Expired Personal Access Tokens (PATs) are recorded in Docker Desktop diagnostic logs CVE-2025-13743 2.4 LowDecember 9, 2025
• docker desktop Multiple DLL Search Order Hijacking Vulnerabilities in Docker Desktop Installer for Windows CVE-2025-9164 8.8 HighOctober 27, 2025
• docker desktop Docker Desktop with ECI Fails to Enforce Socket Command Restrictions CVE-2025-10657 8.7 HighSeptember 26, 2025
• docker desktop Docker Desktop allows unauthenticated access to Docker Engine API from containers CVE-2025-9074 Public exploit 9.3 CriticalAugust 20, 2025
• docker desktop Exposure of system environment variables in Docker Desktop diagnostic logs CVE-2025-6587 5.2 MediumJuly 3, 2025
• docker desktop Exposure in Docker Desktop logs of environment variables configured for running containers CVE-2025-3911 5.2 MediumApril 29, 2025
• docker desktop Registry Access Management (RAM) policies not applied when sign-in enforcement is configured via a configuration profile CVE-2025-4095 4.3 MediumApril 29, 2025
• docker desktop Elevation of Privilege in Docker Desktop for Windows during Upgrade due to Insecure Directory Deletion CVE-2025-3224 7.3 HighApril 28, 2025
• docker desktop Exposure of Proxy Credentials in Docker Desktop Logs CVE-2025-1696 5.2 MediumMarch 6, 2025
• docker desktop Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view CVE-2024-9348 8.9 HighOctober 16, 2024
• docker desktop A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2. CVE-2024-8696 8.9 HighSeptember 12, 2024
• docker desktop A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2. CVE-2024-8695 9.0 CriticalSeptember 12, 2024
• docker desktop In Docker Desktop before v4.29.0 an attacker who has gained access to the Docker Desktop VM through a container breakout can further escape to the host by passing extensions and dashboard related IPC… CVE-2024-6222 7.3 HighJuly 9, 2024
• docker desktop In Docker Desktop on Windows before v4.31.0 allows a user in the docker-users group to cause a Windows Denial-of-Service through the exec-path Docker daemon config option in Windows containers mode CVE-2024-5652 6.1 MediumJuly 9, 2024
• docker desktop In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in LPE CVE-2023-0633 7.2 HighSeptember 25, 2023
• docker desktop Docker Desktop 4.11.x allows --no-windows-containers flag bypass CVE-2023-0627 6.7 MediumSeptember 25, 2023
• docker desktop Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route CVE-2023-0626 8.0 HighSeptember 25, 2023
• docker desktop Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog CVE-2023-0625 8.0 HighSeptember 25, 2023
• docker desktop Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL CVE-2023-5166 8.0 HighSeptember 25, 2023
• docker desktop Docker Desktop before 4.23.0 allows Enhanced Container Isolation bypass via debug shell CVE-2023-5165 7.1 HighSeptember 25, 2023
• docker desktop Docker Desktop for Windows before 4.6 allows attackers to overwrite any file through the... CVE-2022-38730 6.3 MediumApril 27, 2023
• docker desktop Docker Desktop for Windows before 4.6.0 allows attackers to delete (or create) any file through... CVE-2022-37326 7.8 HighApril 27, 2023
• docker desktop Docker Desktop for Windows before 4.6.0 allows attackers to overwrite any file through a symlink... CVE-2022-34292 7.1 HighApril 27, 2023
• docker desktop Docker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv... CVE-2022-31647 7.1 HighApril 27, 2023
• docker desktop In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed CVE-2023-1802 5.9 MediumApril 6, 2023
• docker desktop Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation restrictions via the raw Docker socket and launch privileged containers CVE-2023-0629 7.1 HighMarch 13, 2023
• docker desktop Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:… CVE-2023-0628 6.1 MediumMarch 13, 2023
• docker desktop Docker Desktop 4.3.0 has Incorrect Access Control. CVE-2021-44719 8.4 HighMay 25, 2022
• docker desktop Docker Desktop installer on Windows in versions before 4.6.0 allows an attacker to overwrite any... CVE-2022-26659 7.1 HighMarch 25, 2022
• docker desktop Docker Desktop before 4.4.4 on Windows allows attackers to move arbitrary files. CVE-2022-23774 5.3 MediumFebruary 1, 2022
• docker desktop Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token... CVE-2021-45449 5.5 MediumJanuary 12, 2022
• docker desktop Docker Desktop before 3.6.0 suffers from incorrect access control. If a low-privileged account is... CVE-2021-37841 7.8 HighAugust 12, 2021
• docker desktop com.docker.vmnetd in Docker Desktop 2.3.0.3 allows privilege escalation because of a lack of... CVE-2020-15360 7.8 HighJune 27, 2020
• docker desktop An issue was discovered in Docker Desktop through 2.2.0.5 on Windows. If a local attacker sets up... CVE-2020-11492 Public exploit 7.8 HighJune 5, 2020
• docker desktop Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the... CVE-2020-10665 Public exploit 6.7 MediumMarch 18, 2020
• docker desktop community edition, docker, apache geode +2 more Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing... CVE-2019-15752 In KEVPublic exploit EPSS 48.8% 7.8 HighAugust 28, 2019