CVE-2026-106581 — Docker Desktop for Windows installer failed to verify external packages
Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a craf…
Published: 2026-10-09 · CVSS: 8.2 · CVSS 4.0
Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer actions as LocalSystem.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7