CVE-2026-106581: Docker Desktop for Windows installer failed to verify external packages

Q: Who is exposed to this issue?

Systems running Docker Desktop for Windows before 4.92.0 are exposed when Docker Desktop Installer.exe is used with the install -package option. Exploitation also requires a user to approve the Docker-signed UAC prompt.

Q: What does an attacker need to exploit it?

The attacker must be able to supply a crafted package to Docker Desktop Installer.exe through the install -package option and persuade a user to approve the resulting UAC prompt. Successful exploitation allows attacker-controlled installer actions to run as LocalSystem.

Q: How can I determine whether a system is affected?

Check the installed Docker Desktop for Windows version and whether the environment uses Docker Desktop Installer.exe install -package. Versions before 4.92.0 did not verify the signature of the supplied package.

Published Oct 9, 2026

Updated

Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer actions as LocalSystem.

Affected Software

1 affected component

Docker Docker Desktop for Windows<4.92.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Docker Desktop for Windows to a version that resolves this vulnerability.
Fixed in 4.92.0

Event History

Oct 9, 2026

CVE Published

via MITRE·01:40 PM

Data Sourced

via MITRE·01:40 PM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Systems running Docker Desktop for Windows before 4.92.0 are exposed when Docker Desktop Installer.exe is used with the install -package option. Exploitation also requires a user to approve the Docker-signed UAC prompt.

What does an attacker need to exploit it?

The attacker must be able to supply a crafted package to Docker Desktop Installer.exe through the install -package option and persuade a user to approve the resulting UAC prompt. Successful exploitation allows attacker-controlled installer actions to run as LocalSystem.

How can I determine whether a system is affected?

Check the installed Docker Desktop for Windows version and whether the environment uses Docker Desktop Installer.exe install -package. Versions before 4.92.0 did not verify the signature of the supplied package.

CVE-2026-106581: Docker Desktop for Windows installer failed to verify external packages

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I determine whether a system is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I determine whether a system is affected?