VulnerabilityPublished 15 Apr 2026

ZDI-26-261: (0Day) Docker Desktop credentialHelper Directory Traversal Privilege Escalation Vulnerability

Source Zero Day Initiative

Severity

High

Rated High by Zero Day Initiative

Data as of 26 May 2026, 20:33 UTC

local

What to do

AI-suggested

The vendor rejected the report citing the requirement for prior privileged access. The primary mitigation is to restrict interaction with Docker Desktop to trusted users and environments to reduce the risk of exploitation. Monitor vendor advisories for any future updates or patches.

Description

This vulnerability allows local attackers to escalate privileges on affected installations of Docker Desktop. An attacker must first obtain the ability to escape the container and execute high-privileged code within the Docker Hyper-V VM in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5.

Impact

Successful exploitation allows local attackers who have already escaped the container and obtained high-privileged code execution within the Docker Hyper-V VM to escalate privileges further on the host system. This can lead to arbitrary code execution with the current user's privileges, potentially compromising confidentiality, integrity, and availability of the host system. The CVSS score of 7.5 indicates a high impact vulnerability.

Summary

This vulnerability in Docker Desktop's credentialHelper component involves improper validation of a user-supplied path in the app/settings endpoint, leading to directory traversal. An attacker who has already escaped the container and gained high-privileged code execution within the Docker Hyper-V VM can exploit this to escalate privileges and execute arbitrary code on the host system under the current user's context. The vulnerability was reported to the vendor in July 2025, but the vendor rejected the report due to the prerequisite of prior privileged access. The Zero Day Initiative assigned a CVSS score of 7.5 (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H). The recommended mitigation is to restrict interaction with Docker Desktop to trusted users and environments.

References

zerodayinitiative.com/advisories/ZDI-26-261/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 26 May 2026, 20:12 UTC

References

Community reviews

Related threats