Docker vulnerabilities
65 CVEs and advisories name Docker as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-115538Docker Engine overlay-network encryption rules are not restored after a firewalld reload
- CVE-2026-115539Cluster-API proxy overwrites forwarded client identity with its own
- CVE-2026-123082Docker Desktop logs can expose the Docker Hub access token
- CVE-2026-121541Bake filesystem path entitlements approval can be skipped in some multi-target builds
- CVE-2026-121542Bake filesystem path entitlements approval can be skipped for path using basename prefix
- CVE-2026-121614Docker Sandboxes host Git executes repository-controlled programs
- CVE-2026-93325Bake filesystem entitlement consent is skipped under --progress=rawjson in Docker Buildx
- CVE-2026-112917Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall
- CVE-2026-103916Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directory
- CVE-2026-114409Docker Desktop logs can expose stored third-party credentials
- CVE-2026-105445Docker Hub account conversion could reassign an active personal access token to another user
- CVE-2026-106581Docker Desktop for Windows installer failed to verify external packages
- CVE-2026-105452Docker Sandboxes egress proxy could forward unrecognized client credentials to managed hosts
- CVE-2026-101998Fail-open response masking in Docker Sandboxes can expose proxy-managed credentials
- CVE-2026-105570Docker Sandboxes OAuth response masking could be bypassed with a case-variant token host
- CVE-2026-92543Docker Engine insecure-registry fallback via malicious DNS responses
- CVE-2026-92542Blind VXLAN injection into encrypted overlay networks from cluster peer
- CVE-2026-103433Bake filesystem entitlement consent is skipped for certain secret and oci-layout definitions
- CVE-2026-79994Docker Sandboxes UDS forwarder can reach arbitrary host Unix sockets through a symlink race
- CVE-2026-55887MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway
- CVE-2026-77179Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback
- CVE-2026-17106Tar extraction in moby/go-archive can write outside the destination directory via link following
- CVE-2026-18171Docker Sandboxes read-only runtime mount writable through its shared-export alias
- CVE-2026-12539Docker Sandboxes ICMP egress restriction bypass after daemon restart
- CVE-2026-12039Docker Sandboxes network egress allowlist bypass via unfiltered DNS resolution
- CVE-2026-41567Docker: `PUT /containers/{id}/archive` executes container binary on the host
- CVE-2026-8936Unbounded recursion in grpcfuse kernel module allows container to crash Docker Desktop VM
- CVE-2026-5843Docker Model Runner container-to-host code execution via MLX-LM model_file importlib loading
- CVE-2026-5817Docker Model Runner container-to-host code execution via unsandboxed trust_remote_code in Python inference backends
- CVE-2026-6406Docker Desktop Enhanced Container Isolation bypass via --use-api-socket CLI flag