ZDI-26-261: (0Day) Docker Desktop credentialHelper Directory Traversal Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Docker Desktop. An attacker must first obtain the ability to escape the container and execute high-privileged code within the Docker Hyper-V VM in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5.
AI Analysis
Technical Summary
This vulnerability in Docker Desktop's credentialHelper component involves improper validation of a user-supplied path in the app/settings endpoint, leading to directory traversal. An attacker who has already escaped the container and gained high-privileged code execution within the Docker Hyper-V VM can exploit this to escalate privileges and execute arbitrary code on the host system under the current user's context. The vulnerability was reported to the vendor in July 2025, but the vendor rejected the report due to the prerequisite of prior privileged access. The Zero Day Initiative assigned a CVSS score of 7.5 (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H). No patch or official remediation has been provided as of the advisory date. The recommended mitigation is to restrict interaction with Docker Desktop to trusted users and environments.
Potential Impact
Successful exploitation allows local attackers who have already escaped the container and obtained high-privileged code execution within the Docker Hyper-V VM to escalate privileges further on the host system. This can lead to arbitrary code execution with the current user's privileges, potentially compromising confidentiality, integrity, and availability of the host system. The CVSS score of 7.5 indicates a high impact vulnerability.
Mitigation Recommendations
No official patch or fix is currently available for this vulnerability. The vendor rejected the report citing the requirement for prior privileged access. The primary mitigation is to restrict interaction with Docker Desktop to trusted users and environments to reduce the risk of exploitation. Monitor vendor advisories for any future updates or patches.
ZDI-26-261: (0Day) Docker Desktop credentialHelper Directory Traversal Privilege Escalation Vulnerability
Description
This vulnerability allows local attackers to escalate privileges on affected installations of Docker Desktop. An attacker must first obtain the ability to escape the container and execute high-privileged code within the Docker Hyper-V VM in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Docker Desktop's credentialHelper component involves improper validation of a user-supplied path in the app/settings endpoint, leading to directory traversal. An attacker who has already escaped the container and gained high-privileged code execution within the Docker Hyper-V VM can exploit this to escalate privileges and execute arbitrary code on the host system under the current user's context. The vulnerability was reported to the vendor in July 2025, but the vendor rejected the report due to the prerequisite of prior privileged access. The Zero Day Initiative assigned a CVSS score of 7.5 (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H). No patch or official remediation has been provided as of the advisory date. The recommended mitigation is to restrict interaction with Docker Desktop to trusted users and environments.
Potential Impact
Successful exploitation allows local attackers who have already escaped the container and obtained high-privileged code execution within the Docker Hyper-V VM to escalate privileges further on the host system. This can lead to arbitrary code execution with the current user's privileges, potentially compromising confidentiality, integrity, and availability of the host system. The CVSS score of 7.5 indicates a high impact vulnerability.
Mitigation Recommendations
No official patch or fix is currently available for this vulnerability. The vendor rejected the report citing the requirement for prior privileged access. The primary mitigation is to restrict interaction with Docker Desktop to trusted users and environments to reduce the risk of exploitation. Monitor vendor advisories for any future updates or patches.
Technical Details
- Article Source
- {"url":"http://www.zerodayinitiative.com/advisories/ZDI-26-261/","fetched":true,"fetchedAt":"2026-05-26T19:58:57.377Z","wordCount":280}
Threat ID: 6a15fc93e29bf47b5055e0d9
Added to database: 5/26/2026, 8:03:31 PM
Last enriched: 5/26/2026, 8:12:50 PM
Last updated: 5/27/2026, 4:49:19 AM
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.