CVE-2019-15752: Docker Desktop Community Edition Privilege Escalation Vulnerability

Vulnerability summary

CVE-2019-15752 is a high (CVSS 9.3) vulnerability in Docker Desktop Community Edition. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 48.63% chance of exploitation in the next 30 days, higher than 98.8% of scored vulnerabilities. 4 public exploits are recorded.

Timeline

1. 28-08-2019
   PublishedVulnerability first disclosed.
2. 03-11-2021
   Added to CISA KEVDocker Desktop Community Edition Privilege Escalation Vulnerability
3. 03-05-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.

• CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.