Docker Desktop vulnerabilities

• docker desktop Docker Model Runner container-to-host code execution via MLX-LM model_file importlib loading CVE-2026-5843 Public exploit 8.8 HighMay 22, 2026
• docker desktop Docker Model Runner container-to-host code execution via unsandboxed trust_remote_code in Python inference backends CVE-2026-5817 Public exploit 8.8 HighMay 22, 2026
• docker desktop Docker Desktop Enhanced Container Isolation bypass via --use-api-socket CLI flag CVE-2026-6406 8.8 HighMay 22, 2026
• docker desktop Expired Personal Access Tokens (PATs) are recorded in Docker Desktop diagnostic logs CVE-2025-13743 2.4 LowDecember 9, 2025
• docker desktop A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2. CVE-2024-8696 8.9 HighSeptember 12, 2024
• docker desktop A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2. CVE-2024-8695 9.0 CriticalSeptember 12, 2024
• docker desktop In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in LPE CVE-2023-0633 7.2 HighSeptember 25, 2023
• docker desktop Docker Desktop 4.11.x allows --no-windows-containers flag bypass CVE-2023-0627 6.7 MediumSeptember 25, 2023
• docker desktop Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route CVE-2023-0626 8.0 HighSeptember 25, 2023
• docker desktop Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog CVE-2023-0625 8.0 HighSeptember 25, 2023
• docker desktop Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL CVE-2023-5166 8.0 HighSeptember 25, 2023
• docker desktop Docker Desktop before 4.23.0 allows Enhanced Container Isolation bypass via debug shell CVE-2023-5165 7.1 HighSeptember 25, 2023
• docker desktop Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation restrictions via the raw Docker socket and launch privileged containers CVE-2023-0629 7.1 HighMarch 13, 2023
• docker desktop Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:… CVE-2023-0628 6.1 MediumMarch 13, 2023
• docker desktop Docker Desktop 4.3.0 has Incorrect Access Control. CVE-2021-44719 8.4 HighMay 25, 2022
• docker desktop Docker Desktop installer on Windows in versions before 4.6.0 allows an attacker to overwrite any... CVE-2022-26659 7.1 HighMarch 25, 2022
• docker desktop Docker Desktop before 4.4.4 on Windows allows attackers to move arbitrary files. CVE-2022-23774 5.3 MediumFebruary 1, 2022
• docker desktop Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token... CVE-2021-45449 5.5 MediumJanuary 12, 2022
• docker desktop com.docker.vmnetd in Docker Desktop 2.3.0.3 allows privilege escalation because of a lack of... CVE-2020-15360 7.8 HighJune 27, 2020
• docker desktop An issue was discovered in Docker Desktop through 2.2.0.5 on Windows. If a local attacker sets up... CVE-2020-11492 Public exploit 7.8 HighJune 5, 2020