CVE-2026-106581: Docker Desktop for Windows installer failed to verify external packages
Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer actions as LocalSystem.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Docker Desktop for Windowsto a version that resolves this vulnerability.Fixed in 4.92.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running Docker Desktop for Windows before 4.92.0 are exposed when Docker Desktop Installer.exe is used with the install -package option. Exploitation also requires a user to approve the Docker-signed UAC prompt.
What does an attacker need to exploit it?
The attacker must be able to supply a crafted package to Docker Desktop Installer.exe through the install -package option and persuade a user to approve the resulting UAC prompt. Successful exploitation allows attacker-controlled installer actions to run as LocalSystem.
How can I determine whether a system is affected?
Check the installed Docker Desktop for Windows version and whether the environment uses Docker Desktop Installer.exe install -package. Versions before 4.92.0 did not verify the signature of the supplied package.