Servers and applications
CVE-2019-15752
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 3 Nov 2021.
- Severity
- High 7.8
- Published
- 28 Aug 2019
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 21 Oct 2026
- Fixed in
- 2.1.0.1
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Docker EngineServers and applications · cpe:a:docker:docker |
|
Known exploited
- CISA name
- Docker Desktop Community Edition Privilege Escalation Vulnerability
- Required action
- Apply updates per vendor instructions.
- Due for US agencies
- 3 May 2022
- Used in ransomware
- Not known