What’s Vulnerable › Products

Docker Desktop vulnerabilities

24 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.

Check whether your Docker Desktop version is affected

Latest Docker Desktop vulnerabilities

• CVE-2026-106581 — Docker Desktop for Windows installer failed to verify external packages (CVSS 7.3)
• CVE-2026-17106 — Tar extraction in moby/go-archive can write outside the destination directory via link following (CVSS 7.1)
• CVE-2026-8936 — Unbounded recursion in grpcfuse kernel module allows container to crash Docker Desktop VM (CVSS 8.2)
• CVE-2026-2664 — Out of bounds read vulnerability in grpcfuse kernel module (CVSS 7.8)
• CVE-2025-9164 — Multiple DLL Search Order Hijacking Vulnerabilities in Docker Desktop Installer for Windows (CVSS 8.8)
• CVE-2025-10657 — Docker Desktop with ECI Fails to Enforce Socket Command Restrictions (CVSS 8.7)
• CVE-2025-9074 — Docker Desktop allows unauthenticated access to Docker Engine API from containers (CVSS 9.3)
• CVE-2025-6587 — Exposure of system environment variables in Docker Desktop diagnostic logs (CVSS 5.2)
• CVE-2025-4095 — Registry Access Management (RAM) policies not applied when sign-in enforcement is configured via a configuration profile (CVSS 4.3)
• CVE-2025-3911 — Exposure in Docker Desktop logs of environment variables configured for running containers (CVSS 5.2)
• CVE-2025-3224 — Elevation of Privilege in Docker Desktop for Windows during Upgrade due to Insecure Directory Deletion (CVSS 7.8)
• CVE-2025-1696 — Exposure of Proxy Credentials in Docker Desktop Logs (CVSS 5.2)
• CVE-2024-9348 — Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view (CVSS 8.9)
• CVE-2024-8696 — A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2. (CVSS 9.8)
• CVE-2024-8695 — A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2. (CVSS 9.8)
• CVE-2024-6222 — In Docker Desktop before v4.29.0 an attacker who has gained access to the Docker Desktop VM through a container breakout can further escape to the host by passing extensions and dashboard related IPC messages (CVSS 7.0)
• CVE-2024-5652 — In Docker Desktop on Windows before v4.31.0 allows a user in the docker-users group to cause a Windows Denial-of-Service through the exec-path Docker daemon config option in Windows containers mode (CVSS 5.5)
• CVE-2022-38730 — (CVSS 6.3)
• CVE-2022-37326 — (CVSS 7.8)
• CVE-2022-34292 — (CVSS 7.1)
• CVE-2022-31647 — (CVSS 7.1)
• CVE-2023-1802 — In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed (CVSS 7.5)
• CVE-2021-37841 — (CVSS 7.8)
• CVE-2020-10665 — (CVSS 6.7)