Docker Docker_desktop
18 CVEs affecting Docker Docker_desktop. Latest disclosed: 2026-05-22. Critical: 0, High: 14.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6406 | High | 8.8 | 2026-05-22 | The Docker CLI --use-api-socket flag bypasses Enhanced Container Isolation (ECI) restrictions in Docker Desktop. When ECI is enabled, Docker socket mounts from… |
CVE-2021-44719 | High | 8.4 | 2022-05-25 | Docker Desktop 4.3.0 has Incorrect Access Control. |
CVE-2026-5843 | High | 8.2 | 2026-05-22 | The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model… |
CVE-2026-5817 | High | 8.2 | 2026-05-22 | The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizers, and runs without sa… |
CVE-2023-5166 | High | 8.0 | 2023-09-25 | Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL. This issue affects Docker Desktop: before 4.23.0. |
CVE-2023-0626 | High | 8.0 | 2023-09-25 | Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route. This issue affects Docker Desktop: before 4.12.0. |
CVE-2023-0625 | High | 8.0 | 2023-09-25 | Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog. This issue affects Docker Desktop: before 4.12.0. |
CVE-2020-15360 | High | 7.8 | 2020-06-27 | com.docker.vmnetd in Docker Desktop 2.3.0.3 allows privilege escalation because of a lack of client verification. |
CVE-2020-11492 | High | 7.8 | 2020-06-05 | An issue was discovered in Docker Desktop through 2.2.0.5 on Windows. If a local attacker sets up their own named pipe prior to starting Docker with the same n… |
CVE-2025-13743 | High | 7.5 | 2025-12-09 | Docker Desktop diagnostics bundles were found to include expired Hub PATs in log output due to error object serialization. This poses a risk of leaking sensiti… |
CVE-2023-0633 | High | 7.2 | 2023-09-25 | In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in local privilege escalation (LPE).This issue affects Docker Desktop… |
CVE-2023-5165 | High | 7.1 | 2023-09-25 | Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions via the debug shell which remains accessible… |
CVE-2023-0629 | High | 7.1 | 2023-03-13 | Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to docker.raw.soc… |
CVE-2022-26659 | High | 7.1 | 2022-03-25 | Docker Desktop installer on Windows in versions before 4.6.0 allows an attacker to overwrite any administrator writable files by creating a symlink in place of… |
CVE-2023-0627 | Medium | 6.7 | 2023-09-25 | Docker Desktop 4.11.x allows --no-windows-containers flag bypass via IPC response spoofing which may lead to Local Privilege Escalation (LPE).This issue affect… |
CVE-2023-0628 | Medium | 6.1 | 2023-03-13 | Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to… |
CVE-2021-45449 | Medium | 5.5 | 2022-01-12 | Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during login. This only af… |
CVE-2022-23774 | Medium | 5.3 | 2022-02-01 | Docker Desktop before 4.4.4 on Windows allows attackers to move arbitrary files. |