Vulnerability · Published Oct 9, 2026 · Assigned by Docker
CVE-2026-106581Docker Desktop for Windows installer failed to verify external packages
High 8.2
In plain English
A high-severity security flaw in Docker Desktop from Docker. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).
Severity (CVSS 4.0)8.2High
Exploit odds (30 days)<0.1%top 99.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer actions as LocalSystem.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Docker | Docker Desktop | 0 – before 4.92.0 |
Weakness: CWE-347 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- https://docs.docker.com/desktop/release-notes/#4920 release-notes