CVE-2026-106581

Executive Summary

CVE-2026-106581 is a signature-verification failure (CWE-347, Improper Verification of Cryptographic Signature) in Docker Desktop for Windows prior to version 4.92.0. The installer binary Docker Desktop Installer.exe accepts a package supplied via the install -package argument without validating that package's signature. An attacker who can supply a crafted package and persuade a user to approve the legitimate Docker-signed UAC elevation prompt can cause attacker-controlled installer actions to execute with LocalSystem privileges. Impact is complete local privilege escalation to the highest Windows integrity level and, due to the administrative context, potential full host compromise.

Technical Analysis

The vulnerability is a broken trust decision in the installation/update path rather than a memory-safety defect. Docker Desktop for Windows is installed and upgraded by a signed bootstrapper/installer executable, Docker Desktop Installer.exe. That installer supports a -package argument that points to an external installation package (the payload containing the component set the installer will unpack and execute). Per the NVD description, versions before 4.92.0 "did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package."

The security property that is violated is authenticity and integrity: the installer is expected to establish that the supplied package is a genuine, Docker-signed artifact before trusting its contents. Because this verification is absent, the installer treats an arbitrary, attacker-controlled package as if it were a legitimate Docker payload and processes it.

Three attributes of this design amplify the flaw into privilege escalation:

1. Elevation boundary crossing. Docker Desktop Installer.exe is a Docker-signed binary that the operating system trusts to request administrative rights. When a user approves its UAC prompt, the user is authorizing the known, signed Docker installer — not the package content that the installer subsequently consumes. The signature on the executable satisfies the user's and the OS's trust check, but no equivalent check is applied to the data the executable acts upon. This is a classic "trusted binary, untrusted payload" gap.

2. Privileged execution context. Any actions the installer performs on behalf of the supplied package — unpacking, copying, service and driver installation, registry writes, or command invocation — run in the elevated security context the user granted, which is LocalSystem. The vulnerability class (CWE-347) is an authentication/authorization bypass of the artifact pipeline; the resulting impact is arbitrary action as LocalSystem.

3. Local attack vector with user interaction. The attacker must already be able to deliver a package file to the target and induce the user to run the installer against it. This raises the practical bar (no unauthenticated remote trigger), but is realistic in phishing, lateral-movement, and shared/untrusted-download scenarios where users are accustomed to running installers.

The root cause is trust placed in a parameter-supplied artifact path without a corresponding signature/chain-of-trust check. The precise code location responsible for the missing check is not disclosed in the NVD description; no function names, class names, or internal API paths are provided in the source data, and none are asserted here. What is derivable is the class of failure: an unverified external input (the -package value) is engaged at an elevated integrity level.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available; the attack chain below is inferred from the vulnerability class and the installer behavior described in the NVD entry. It does not rely on any specific internal function names, because none are disclosed.

1. Reconnaissance / target identification. The attacker identifies a Windows host with an affected Docker Desktop version (< 4.92.0) installed or being installed. Version information is obtainable from installed program metadata, registry keys, or prior knowledge of the environment during lateral movement. The attacker also needs a delivery channel that can place a file on the host and a social-engineering pretext to get the user to run the installer (email attachment, chat/messaging delivery, shared drive, or a dropped file in a user-writable directory).

2. Triggering the defective trust decision. The attacker crafts a malicious package file and delivers it to the target. The user is then convinced to execute Docker Desktop Installer.exe install -package <attacker_package>. Because the vulnerable installer does not verify the package signature, it does not reject the crafted package for being unsigned or non-Docker-signed; it proceeds to process it. No exploitation of memory corruption or network exposure is required — the flaw is triggered purely by supplying an unverified artifact to a trusted, elevated binary.

3. Payload / execution method (class level). The crafted package supplies the installer actions the installer will execute. At the vulnerability-class level, the impact is "attacker-controlled installer actions as LocalSystem": the malicious content is acted upon by the elevated installer rather than being rejected. Because no function-level or file-path detail of the packaging format is disclosed in the source data, the specific internal mechanism by which actions are staged is not asserted here. The essential point is that the contents of the attacker package, not the signed installer binary, determine what runs.

4. Post-exploitation impact. With installer actions executing as LocalSystem, an attacker reaches the highest privilege level on the endpoint. From there, a realistic objective set includes persistence (services or scheduled tasks), disabling or tampering with security controls, credential theft from local SAM/LSA and from tokens on the host, and pivoting into the container runtime and any images, build contexts, or registry credentials that the developer workstation holds. On a developer endpoint, container registries, CI tokens, cloud credentials, and source repositories reachable from the host form a high-value lateral target set.

Impact Assessment

Successful exploitation yields local privilege escalation to LocalSystem through a trusted, OS-elevated installer, i.e., a full compromise of the confidentiality, integrity, and availability of the host and, by extension, of any secrets the host can reach. The relevant CVSS characteristics are Local attack vector and User Interaction: Required (the UAC approval), but Scope: Changed and High confidentiality/integrity/availability impact once the attacker-controlled package executes at the highest privilege level — the exploited component (the unsigned package) gains authority over a component (the LocalSystem installation context and the host) it should not control, and High C implies the developer secrets and credentials exposed on the endpoint. The provided data lists no CNA-assigned CVSS score or vector, so the vector shown in METADATA is an analyst-derived CVSS 3.1 vector inferred from the described mechanism rather than a vendor-published score.

Business blast radius centers on developer and DevOps workstations, because Docker Desktop for Windows is a developer-facing product. A single compromised developer host can translate into supply-chain risk: credentials and access tokens, container images under the developer's control, and CI/CD trust relationships are all reachable once LocalSystem is achieved. Because the flaw is local and requires the user to approve UAC, mass exploitation is unlikely, but targeted compromise of high-value developer endpoints is realistic. No CISA KEV listing, no EPSS score, and no in-the-wild exploitation reporting are present in the source data.

Detection Guidance

Sigma Rule

title: Docker Desktop Installer Invoked With External -package Argument
id: 7b2e5c1a-9d4f-4c8b-a1e2-3f6c0d9e8a11
status: experimental
description: Detects execution of Docker Desktop Installer.exe with the install -package argument, the code path abused by CVE-2026-106581 to execute an unverified package as LocalSystem.
author: valtersit.com
date: 2026-06-01
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: '\Docker Desktop Installer.exe'
    - OriginalFileName: 'Docker Desktop Installer.exe'
  selection_args:
    CommandLine|contains|all:
      - 'install'
      - '-package'
  condition: selection_img and selection_args
falsepositives:
  - Legitimate offline or enterprise deployments that intentionally pass a -package value (correlate with an approved change ticket and a known package hash).
level: high
tags:
  - attack.t1548
  - attack.defense_evasion

YARA Rule

rule CVE_2026_106581_Docker_Installer_Package_Arg
{
    meta:
        author      = "valtersit.com"
        description = "Detects processes/command lines referencing Docker Desktop Installer install -package (CVE-2026-106581)"
        reference   = "CVE-2026-106581"
        date        = "2026-06-01"
        severity    = "high"

    strings:
        $installer = "Docker Desktop Installer.exe" ascii wide nocase
        $arg_inst  = "install" ascii wide nocase
        $arg_pkg   = "-package" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D and $installer and $arg_inst and $arg_pkg
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106581 Suspected Download of Docker Installer Package Payload"; flow:established,to_client; http.user_agent; content:"Docker"; http.response_body; content:"MZ"; distance:0; filestore; filemagic:"PE32"; metadata:cve CVE-2026-106581; reference:cve,2026-106581; classtype:attempted-user; sid:2026106581; rev:1;)

Note: this vulnerability is local (package delivered to a host). Network telemetry can only observe the probable delivery stage — the transfer of an installer/package artifact to a Windows endpoint. The rule is a triage aid, not a direct proof of exploit.

Elastic Detection

process where event.type == "start" and
  process.name : "Docker Desktop Installer.exe" and
  process.command_line : "*install*" and
  process.command_line : "*-package*"

Splunk SPL Query

index=windows EventCode=4688 OR EventCode=1
| where match(lower(Image), "docker desktop installer\\.exe$")
| where match(CommandLine, "(?i)install") AND match(CommandLine, "(?i)-package")
| table _time, host, User, ParentImage, Image, CommandLine
| sort - _time

Wazuh OSSEC Rule

<group name="windows,sysmon,docker,">
  <rule id="1065810" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.image">Docker Desktop Installer\.exe$</field>
    <field name="win.eventdata.commandLine">-package</field>
    <description>CVE-2026-106581: Docker Desktop Installer invoked with -package argument (possible unverified package execution)</description>
    <mitre>
      <id>T1548</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Although the NVD description references behavior "Before 4.92.0," no vendor advisory, changelog entry, commit, or download link was captured in the tracked data, and no workarounds were provided. Treat remediation as unverified until independently confirmed against Docker's official release channels.

1. Immediate mitigations (pre-patch / verification pending):

   • Do not run Docker Desktop Installer.exe install -package <path> with a package of unknown or unverified provenance. Establish a strict policy that only packages whose signature can be independently verified (e.g., via Get-AuthenticodeSignature or equivalent) are passed to the installer.
   • Enforce application control (WDAC / AppLocker) so that only authorized, signed installers and only approved package artifacts are permitted to execute or be consumed on developer endpoints.
   • Add the Sigma/Splunk/Wazuh detections above to alert on any install -package invocation and triage every hit.
   • Restrict the ability of standard users to deliver files that later get executed via an elevated installer; increase monitoring on developer endpoints with elevated-token activity.

2. Patch / upgrade steps: If and when a verified fixed release aligned with the described "4.92.0" boundary is confirmed through Docker's official distribution channel, upgrade every affected Windows endpoint to that version or later. Verify the upgrade artifact's Authenticode signature before deployment, and confirm the installed version from program metadata or the registry after upgrade. Until a signed fixed build is verified, do not assume the flaw is remediated.

3. Long-term hardening:

   • Adopt a policy that elevated installers must validate the integrity and authenticity of every externally-supplied artifact before acting on it (defense against the CWE-347 class generally).
   • Maintain an inventory and version baseline for Docker Desktop across developer fleets so affected versions are discoverable quickly.
   • Reduce the value of LocalSystem compromise on developer hosts: limit long-lived registry, cloud, and CI credentials stored on endpoints; prefer short-lived, scoped tokens.
   • Monitor Docker's security advisories and the NVD record for this CVE and reselect the patch-confidence assessment once authoritative evidence is published.

References

• NVD — CVE-2026-106581: https://nvd.nist.gov/vuln/detail/CVE-2026-106581
• CWE-347, Improper Verification of Cryptographic Signature: https://cwe.mitre.org/data/definitions/347.html
• MITRE ATT&CK T1548, Abuse Elevation Control Mechanism: https://attack.mitre.org/techniques/T1548/
• Docker security advisories (vendor release channel — verify the 4.92.0 remediation and signing details here): https://docs.docker.com/security/
• CISA KEV Catalog (no entry for CVE-2026-106581 as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat-actor and in-the-wild evidence: none present in the source data. No public PoC, no Nuclei template, no exploit code, no EPSS score, and no CISA KEV listing were available at the time of writing; exploitation status is unknown and should be treated as unproven.