GO-2026-4610 | Vulnetix

GO-2026-4610 PUBLISHED CVSS 8.5 HIGH

Record from OSV · Published March 10, 2026

Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
kyverno-fips-1.17	Chainguard	1.17.1-r4
neuvector-sigstore-interface-fips	Chainguard	0_git20260306-r0
flux-notification-controller	Wolfi	1.8.1-r1
kubescape-operator-fips	Chainguard	0.2.129-r2
kubeflow-katib	Wolfi	0.19.0-r6
k9s	Chainguard	0.50.18-r6
istio-fips-1.28	Chainguard	1.28.4-r3
nerdctl	Chainguard	2.2.1-r4
kyverno-1.16	Chainguard	1.16.3-r8
trufflehog-fips	Chainguard	3.93.7-r1
istio-1.27	Chainguard	1.27.7-r2
dagdotdev	Chainguard	0.0.20-r4

86 more packages have a fixed version. See every fix in Lookup.

CVSS 4.0

8.5

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Vendor	Product	Versions
chainguard	kyverno-fips-1.17	0
chainguard	neuvector-sigstore-interface-fips	0
wolfi	flux-notification-controller	0
chainguard	gatekeeper-3.21	*
chainguard	kubescape-operator-fips	0
wolfi	docker-credential-gcr	*
chainguard	k8sgpt	*
wolfi	gatekeeper-3.22	*
wolfi	kubeflow-katib	0
chainguard	k9s	0
chainguard	istio-fips-1.28	0
chainguard	nerdctl	0
chainguard	kyverno-1.16	0
chainguard	trufflehog-fips	0
chainguard	istio-1.27	0
chainguard	dagdotdev	0
wolfi	argo-workflows-4.0	0
wolfi	vexctl	0
chainguard	rke2-runtime-1.33	0
chainguard	gitlab-runner-18.9	*

…and 333 more

The same record, from the CLI:

vulnetix vdb vuln GO-2026-4610
vulnetix vdb fixes GO-2026-4610

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GO-2026-4610/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart