CVE-2019-15752: Docker Desktop Community Edition Privilege Escalation Vulnerability
High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 48.6% chance of exploitation in the next 30 days.
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.
Affected products
Published 2019-08-28. Last modified 2026-06-17.