CVE-2026-6406
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Docker CLI --use-api-socket flag bypasses Enhanced Container Isolation (ECI) restrictions in Docker Desktop. When ECI is enabled, Docker socket mounts from containers are denied unless explicitly allowed. The --use-api-socket flag adds the mount via HostConfig.Mounts instead of HostConfig.Binds, and ECI enforcement only inspects Binds, allowing the mount to pass unchecked. This grants a container full access to the Docker Engine socket and, if the host user is logged into container registries, their authentication credentials.
Risk Assessment
A local attacker with the ability to run Docker CLI commands can bypass ECI, access the Docker Engine, and potentially escalate privileges, as well as steal credentials for container registries.
Recommendation
Update Docker Desktop to a version that includes a fix extending ECI checks to the HostConfig.Mounts field.
Other vulnerabilities in Docker Desktop
See all- CVE-2026-112917Critical
In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected.
- CVE-2026-114409Medium
Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials; these OAuth tokens are not Docker account tokens. Versions 4.94.0 and 4.95.0 addressed known logging paths, but logs containing credentials can remain after upgrading, and version 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps.
- CVE-2026-8936High
Docker Desktop 4.76.0 fixes a VM panic caused by unbounded recursion in the grpcfuse kernel module when deeply nested directories are created on a bind-mounted host folder and a dentry invalidation event is triggered.
- CVE-2025-13743High
Docker Desktop diagnostics bundles were found to include expired Hub PATs in log output due to error object serialization. This poses a risk of leaking sensitive information in exported diagnostics, especially when access denied errors occurred.
- CVE-2025-9164High
Docker Desktop Installer.exe is vulnerable to DLL hijacking due to insecure DLL search order. The installer searches for required DLLs in the user's Downloads folder before checking system directories, allowing local privilege escalation through malicious DLL placement. This issue affects Docker Desktop through 4.48.0.
- CVE-2025-10657High
In Docker Desktop 4.46.0 with Enhanced Container Isolation (ECI) enabled and the command restrictions feature in use, the restriction configuration was ignored, allowing any command to be executed on the Docker socket. This affects only containers explicitly allowed by the administrator to mount the Docker socket.
Original NVD description (English source)
The Docker CLI --use-api-socket flag bypasses Enhanced Container Isolation (ECI) restrictions in Docker Desktop. When ECI is enabled, Docker socket mounts from containers are denied unless explicitly allowed via the admin-settings configuration. However, the --use-api-socket flag adds the Docker socket mount via the HostConfig.Mounts field rather than the HostConfig.Binds field. The ECI enforcement in the Docker Desktop API proxy only inspected Binds, allowing the mount to pass unchecked. This grants a container full access to the Docker Engine socket and, if the host user has logged in to container registries, their authentication credentials. A local attacker with the ability to run Docker CLI commands can exploit this to escape ECI restrictions, access the Docker Engine, and potentially escalate privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS