8.9High

CVE-2024-8696A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2.

Docker Docker Desktop; docker docker_desktop Published: 2024-09-12 20:54 (2 years ago)

Description

A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2.

Weakness (CWE): CWE-79 CWE-94

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
Docker	Docker Desktop	< 4.34.2

References and patches

https://docs.docker.com/desktop/release-notes/#4342 release-notes

CVSS score

8.9High

Source: Docker · CVSS 4.0

Attack vector: Network
Attack complexity: High
Attack requirements: Present
Privileges required: None
User interaction: Active
Confidentiality: High
Integrity: High
Availability: High

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS (chance of exploitation in 30 days)

1.23%

higher than 69% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: total

Timeline

ID reserved2024-09-11
Published2024-09-12 20:54
Reached IP-DB2026-10-24 23:54
Last updated2024-09-12 22:27

Assigned by (CNA): Docker

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Docker / Moby

5.7Medium

CVE-2026-123082 yesterday

Docker Desktop logs can expose the Docker Hub access token

Docker Docker Desktop

Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token (a JWT) in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before logging, and a Docker D…

4.5Medium

CVE-2026-121520 8 days ago

Malicious client could set xattr value outside of BuildKit state directory

Moby BuildKit

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. name…

6.7Medium

CVE-2026-121522 8 days ago

Possible panic from Git source resolver

moby BuildKit

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.

5.6Medium

CVE-2026-121541 8 days ago

Bake filesystem path entitlements approval can be skipped in some multi-target builds

Docker Docker Buildx

In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some …

1.8Low

CVE-2026-121542 8 days ago

Bake filesystem path entitlements approval can be skipped for path using basename prefix

Docker Docker Buildx

In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, paths under the same parent directory as the current working dire…

7.1High

CVE-2026-121614 8 days ago

Docker Sandboxes host Git executes repository-controlled programs

Docker Docker Sandboxes

Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attacker who can modify a host repository's Git configuration, for example through a direct-mode sandbox w…