High 7.0Published Mar 4, 2026

CVE-2025-15558Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Updated under an hour ago (Oct 26, 2026, 11:50 PM ET)

Does this affect you?

It affects Docker CLI and 25 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Docker CLI

Exploited in the last 30 days

Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user. This issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/cli@v29.1.5+incompatible/cli-plugins/manager package, such as Docker Compose. This issue does not impact non-Windows binaries, and projects not using the plugin-manager code.

CVSS: 7.0 HIGH (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:N/R:U
Weakness (CWE): CWE-427
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Docker
NVD analysis: Modified
Record last updated: Jul 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Docker Docker CLI docker:cli (from the name)	29.2.0 not affected	CNA record
Docker Compose docker:compose (from the name)	5.1.0 not affected	CNA record
Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 redhat:assisted_installer	2	CISA ADP
Red Hat Builds for Red Hat OpenShift redhat:openshift_builds	1	CISA ADP
Red Hat Gatekeeper 3 redhat:gatekeeper	3	CISA ADP
Red Hat Kernel Module Management Operator for Red Hat Openshift redhat:kernel_module_management	2	CISA ADP
Red Hat Machine Deletion Remediation Operator redhat:workload_availability_mdr	0	CISA ADP
Red Hat Multicluster Engine for Kubernetes redhat:multicluster_engine	Versions not stated	CISA ADP
Red Hat Multicluster Global Hub redhat:multicluster_globalhub	Versions not stated	CISA ADP
Red Hat OpenShift Pipelines redhat:openshift_pipelines	1	CISA ADP
1–10 of 26

References

References

https://docs.docker.com/desktop/release-notes/	release-notes
https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304/	third-party-advisory, not-applicable
https://github.com/docker/cli/pull/6713	patch, issue-tracking
https://access.redhat.com/security/cve/CVE-2025-15558
https://bugzilla.redhat.com/show_bug.cgi?id=2444574
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15558.json

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.