CVE-2023-1802: In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-04-06 · updated 2026-06-17
Weakness: CWE-319

Description

In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and have logged in to a private registry are affected.

Affected products

Docker Desktop: 4.17.0, 4.17.1

References

https://docs.docker.com/desktop/release-notes/#4180
https://github.com/docker/for-win/issues/13344
https://docs.docker.com/desktop/release-notes/#4180
https://github.com/docker/for-win/issues/13344

Get alerted when CVE-2023-1802 or the next vulnerability affects your stack