Docker Desktop
- Software type
- Desktop application
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/07/2026, Docker Desktop recorded 4 security vulnerabilities in the last 90 days, of which 3 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Docker Desktop and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-112917Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcallCVE-2026-114409Docker Desktop logs can expose stored third-party credentialsCVE-2026-106581Docker package signature bypass in Docker Desktop for Windows enables LocalSystem executionCVE-2026-17106Link-following flaw in moby/go-archive enables writes outside the extraction directoryCVE-2026-8936Unbounded recursion in grpcfuse kernel module allows container to crash Docker Desktop VM| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-112917Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall | Exploitation statusNot exploited | FixYes |
| SeverityCritical |
CVE-2026-114409Docker Desktop logs can expose stored third-party credentials | Exploitation statusNot confirmed | FixYes | Published10/27/2026 | SeverityMedium |
|---|
CVE-2026-106581Docker package signature bypass in Docker Desktop for Windows enables LocalSystem execution | Exploitation statusNot exploited | FixYes | Published10/09/2026 | SeverityHigh |
|---|
CVE-2026-17106Link-following flaw in moby/go-archive enables writes outside the extraction directory | Exploitation statusActively exploited | FixYes | Published08/18/2026 | SeverityHigh |
|---|
CVE-2026-8936Unbounded recursion in grpcfuse kernel module allows container to crash Docker Desktop VM | Exploitation statusNot exploited | FixYes | Published06/02/2026 | SeverityHigh |
|---|
CVE-2026-6406Docker Desktop Enhanced Container Isolation bypass via --use-api-socket CLI flag | Exploitation statusNot exploited | FixYes | Published05/22/2026 | SeverityHigh |
|---|
CVE-2026-5843Docker Model Runner container-to-host code execution via MLX-LM model_file importlib loading | Exploitation statusNot exploited | FixYes | Published05/22/2026 | SeverityHigh |
|---|
CVE-2026-5817Docker Model Runner container-to-host code execution via unsandboxed trust_remote_code in Python inference backends | Exploitation statusNot exploited | FixYes | Published05/22/2026 | SeverityHigh |
|---|
CVE-2026-2664Out of bounds read vulnerability in grpcfuse kernel module | Exploitation statusNot exploited | FixYes | Published02/24/2026 | SeverityMedium |
|---|
CVE-2025-13743Expired Personal Access Tokens (PATs) are recorded in Docker Desktop diagnostic logs | Exploitation statusNot exploited | FixYes | Published12/09/2025 | SeverityLow |
|---|
CVE-2025-9164Multiple DLL Search Order Hijacking Vulnerabilities in Docker Desktop Installer for Windows | Exploitation statusNot exploited | FixYes | Published10/27/2025 | SeverityHigh |
|---|
CVE-2025-10657Docker Desktop with ECI Fails to Enforce Socket Command Restrictions | Exploitation statusNot exploited | FixNo | Published09/26/2025 | SeverityHigh |
|---|
CVE-2025-9074Docker Desktop allows unauthenticated access to Docker Engine API from containers | Exploitation statusActively exploited | FixYes | Published08/20/2025 | SeverityCritical |
|---|
CVE-2025-6587Exposure of system environment variables in Docker Desktop diagnostic logs | Exploitation statusNot exploited | FixYes | Published07/03/2025 | SeverityMedium |
|---|
CVE-2025-4095Registry Access Management (RAM) policies not applied when sign-in enforcement is configured via a configuration profile | Exploitation statusNot exploited | FixYes | Published04/29/2025 | SeverityMedium |
|---|
CVE-2025-3911Exposure in Docker Desktop logs of environment variables configured for running containers | Exploitation statusNot exploited | FixYes | Published04/29/2025 | SeverityMedium |
|---|
CVE-2025-3224Elevation of Privilege in Docker Desktop for Windows during Upgrade due to Insecure Directory Deletion | Exploitation statusActively exploited | FixYes | Published04/28/2025 | SeverityHigh |
|---|
CVE-2025-1696Exposure of Proxy Credentials in Docker Desktop Logs | Exploitation statusNot exploited | FixYes | Published03/06/2025 | SeverityMedium |
|---|
CVE-2024-9348Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view | Exploitation statusNot exploited | FixYes | Published10/16/2024 | SeverityHigh |
|---|
CVE-2024-8696A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2. | Exploitation statusNot exploited | FixYes | Published09/12/2024 | SeverityHigh |
|---|
CVE-2024-8695A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2. | Exploitation statusNot exploited | FixYes | Published09/12/2024 | SeverityCritical |
|---|
CVE-2023-1802In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed | Exploitation statusNot exploited | FixYes | Published04/06/2023 | SeverityMedium |
|---|
22 Results | Page 1 of 1