Docker vulnerabilities
125 vulnerabilities
Known vulnerabilities in Docker products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 43 products.
Products
43- Docker37 vulnerabilities
- Docker Desktop34 vulnerabilities
- Desktop13 vulnerabilities
- Docker Sandboxes9 vulnerabilities
- Engine6 vulnerabilities
- Docker Engine5 vulnerabilities
- Command Line Interface2 vulnerabilities
- CS Docker Engine2 vulnerabilities
- Cs Engine2 vulnerabilities
- Libcontainer2 vulnerabilities
- Mcp Gateway2 vulnerabilities
- Model Runner2 vulnerabilities
- Notary2 vulnerabilities
- Adminer1 vulnerabilities
- Buildx1 vulnerabilities
- Cli1 vulnerabilities
- Compose1 vulnerabilities
- Composer Docker Image1 vulnerabilities
- Credential Helpers1 vulnerabilities
- Crux Linux Docker Image1 vulnerabilities
- Docker Buildx1 vulnerabilities
- Docker CLI1 vulnerabilities
- Docker Compose1 vulnerabilities
- Docker Engine Overlay Network Driver1 vulnerabilities
- Docker Hub1 vulnerabilities
- Docker Registry1 vulnerabilities
- Docker Credential Helpers1 vulnerabilities
- Docker Py1 vulnerabilities
- Docker/Daemon1 vulnerabilities
- Docs1 vulnerabilities
- Elixir Alpine Docker Image1 vulnerabilities
- Ghost Alpine Docker Image1 vulnerabilities
- Haproxy Docker Image1 vulnerabilities
- Machine1 vulnerabilities
- Mcp Gateway1 vulnerabilities
- Memcached Docker Image1 vulnerabilities
- Model Runner1 vulnerabilities
- Notary Docker Image1 vulnerabilities
- Rabbitmq Docker Image1 vulnerabilities
- Registry1 vulnerabilities
- Spiped Alpine Docker Image1 vulnerabilities
- Storm Docker Image1 vulnerabilities
- Desktop Community Edition0 vulnerabilities
CVE-2026-105445dockerdocker hub
EPSS score0.41%
An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticated to the registry as the recipient and could pull, push, or delete images, within its scopes, in repositories accessible to that user, including organization repositories.CVE-2018-20699chainguardauditbeat-7+30EPSS score2.23%
Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go.CVE-2018-10892chainguardpy3-docker+29EPSS score1.13%
The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.CVE-2018-15514dockerdockerEPSS score2.47%
HandleRequestAsync in Docker for Windows before 18.06.0-ce-rc3-win68 (edge) and before 18.06.0-ce-win72 (stable) deserialized requests over the \\.\pipe\dockerBackend named pipe without verifying the validity of the deserialized .NET objects. This would allow a malicious user in the "docker-users" group (who may not otherwise have administrator access) to escalate to administrator privileges.CVE-2018-15664debiandocker.io+16EPSS score3.43%
In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).CVE-2021-21285chainguarddocker-machine-driver-harvester+20EPSS score3.29%
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.CVE-2021-21284chainguarddocker-machine-driver-harvester+20EPSS score1.06%
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can modify files under "/var/lib/docker/<remapping>" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user.CVE-2021-41092chainguarddive+8EPSS score1.65%
Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH.CVE-2021-37841dockerdesktopEPSS score1.00%
Docker Desktop before 3.6.0 suffers from incorrect access control. If a low-privileged account is able to access the server running the Windows containers, it can lead to a full container compromise in both process isolation and Hyper-V isolation modes. This security issue leads an attacker with low privilege to read, write and possibly even execute code inside the containers.CVE-2021-44719dockerdocker_desktopEPSS score0.27%
Docker Desktop 4.3.0 has Incorrect Access Control.CVE-2021-45449dockerdocker_desktopEPSS score0.43%
Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during login. This only affects users if they are on Docker Desktop 4.3.0, 4.3.1 and the user has logged in while on 4.3.0, 4.3.1. Gaining access to this data would require having access to the user’s local files.CVE-2021-3162dockerdockerEPSS score0.18%
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.CVE-2015-9259debiannotary+2EPSS score1.29%
In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files, despite a comment stating that it does. Even if a user creates a new root.json file after a key compromise, an attacker can produce update files referring to an old root.json file.CVE-2015-9258debiannotary+3EPSS score1.03%
In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifying the signature algorithm, they might (for example) be able to forge a signature by forcing a misinterpretation of an RSA-PSS key as Ed25519 elliptic-curve data.CVE-2015-3630debiandocker.io+3EPSS score0.55%
Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.CVE-2015-3627chainguarddocker+20EPSS score0.61%
Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.CVE-2015-3629debiandocker.io+4EPSS score0.60%
Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.CVE-2015-3631debiandocker.io+3EPSS score0.57%
Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.CVE-2016-9962chainguardrunc+30EPSS score0.41%
RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container.CVE-2016-6595dockerdockerEPSS score2.82%
The SwarmKit toolkit 1.12.0 for Docker allows remote authenticated users to cause a denial of service (prevention of cluster joins) via a long sequence of join and quit actions. NOTE: the vendor disputes this issue, stating that this sequence is not "removing the state that is left by old nodes. At some point the manager obviously stops being able to accept new nodes, since it runs out of memory. Given that both for Docker swarm and for Docker Swarmkit nodes are *required* to provide a secret token (it's actually the only mode of operation), this means that no adversary can simply join nodes and exhaust manager resources. We can't do anything about a manager running out of memory and not being able to add new legitimate nodes to the system. This is merely a resource provisioning issue, and definitely not a CVE worthy vulnerability.