Docker Desktop Container Isolation Bypass Vulnerability

CVE-2026-6406

What is CVE-2026-6406?

A vulnerability in Docker Desktop allows local attackers to bypass Enhanced Container Isolation (ECI) controls through the Docker CLI’s --use-api-socket flag. When ECI is enabled, socket mounts should be explicitly configured to ensure security. However, the implementation of the --use-api-socket flag circumvents this by adding Docker socket mounts in a manner that the ECI enforcement checks overlook. This flaw can enable attackers to gain unauthorized access to the Docker Engine socket, potentially allowing for privilege escalation and retrieval of sensitive authentication credentials stored by the host user.

References