VDB
GO-2026-4610
GO-2026-4610
PUBLISHED
CVSS 8.5 HIGH
Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli
Risk Scores
CVSS 4.0
8.5
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | kyverno-fips-1.17 | 0, 0, 0 |
| chainguard | neuvector-sigstore-interface-fips | 0, 0, 0 |
| wolfi | flux-notification-controller | 0, 0, 0 |
| chainguard | gatekeeper-3.21 | *, *, * |
| chainguard | kubescape-operator-fips | 0, 0, 0 |
| wolfi | docker-credential-gcr | *, *, * |
| chainguard | k8sgpt | *, *, * |
| wolfi | gatekeeper-3.22 | *, *, * |
| wolfi | kubeflow-katib | 0, 0, 0 |
| chainguard | k9s | 0, 0, 0 |
| chainguard | istio-fips-1.28 | 0, 0, 0 |
| chainguard | nerdctl | 0, 0, 0 |
| chainguard | kyverno-1.16 | 0, 0, 0 |
| chainguard | trufflehog-fips | 0, 0, 0 |
| chainguard | istio-1.27 | 0, 0, 0 |
| chainguard | dagdotdev | 0, 0, 0 |
| wolfi | argo-workflows-4.0 | 0, 0, 0 |
| wolfi | vexctl | 0, 0, 0 |
| chainguard | rke2-runtime-1.33 | 0, 0, 0 |
| chainguard | gitlab-runner-18.9 | *, *, * |
…and 323 more
Timeline
- Mar 10, 2026 CVE Published
- Mar 23, 2026 CVE Updated
References
- https://github.com/docker/cli/security/advisories/GHSA-p436-gjf2-799p advisory
- https://docs.docker.com/desktop/release-notes url
- https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304 url
- https://github.com/docker/cli/pull/6713 fix
- https://github.com/docker/cli/commit/13759330b1f7e7cb0d67047ea42c5482548ba7fa fix
- https://github.com/docker/compose/pull/12300 fix