Docker CLI for Windows versions up to 29.1.5 searches for CLI plugin binaries in a default directory that is not present by default. This allows a low-privileged attacker to create the directory and place malicious executables named as Docker CLI plugins (e.g., docker-compose.exe) that will be executed when the Docker CLI or Docker Desktop is used, potentially resulting in privilege escalation if the CLI is run with elevated privileges. The vulnerability is specific to Windows binaries using the github.com/docker/cli/cli-plugins/manager package and does not affect non-Windows binaries or projects not using this plugin manager code.

An attacker with low privileges on a Windows system can create a directory and place malicious Docker CLI plugin binaries that will be executed by Docker Desktop or Docker CLI plugin features. This can lead to privilege escalation if the Docker CLI is executed with elevated privileges, compromising system security. The vulnerability is rated high severity with a CVSS 4.0 score of 7.0.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There is no explicit patch or fix link provided in the input data. Users should monitor the official Docker and Red Hat advisories for updates. Until a fix is available, avoid running Docker CLI with elevated privileges unnecessarily and restrict the creation of the directory C:\ProgramData\Docker\cli-plugins to trusted users only.