CVE-2019-15752: Docker Desktop Community Edition local privilege escalation via writable credential binary

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityConfirmed in CISA KEV with public exploits and a high EPSS score, though exploitation requires local access and user interaction.

What it is

Docker Desktop Community Edition before 2.1.0.1 assigns incorrect permissions to the %PROGRAMDATA%\DockerDesktop\version-bin\ directory, letting a low-privilege local user drop a Trojan horse docker-credential-wincred.exe there. When an admin or service user authenticates with Docker, restarts Docker, or runs 'docker login', the planted binary executes with that higher-privileged context. It matters because a standard user on a shared Windows host can escalate to admin-level code execution.

Impact

An attacker gains code execution in the context of an administrator or service account, effectively full local privilege escalation with high confidentiality, integrity and availability impact. This can lead to credential theft and full control of the affected Windows host.

Attack surface

Reached locally: the attacker needs write access to the Docker Desktop version-bin directory as a low-privilege user, and the victim must trigger execution by logging in, restarting Docker, or running 'docker login'. The CVSS vector shows local access, no privileges required, but user interaction required.

Exploitation

CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03, and public exploit write-ups exist (Packet Storm, Medium), so exploitation is confirmed in the wild. EPSS gives a 30-day probability of about 0.32 (98th percentile), indicating elevated likelihood.

What to do

• Upgrade Docker Desktop Community Edition to 2.1.0.1 or later, per vendor instructions.
• Restrict write permissions on %PROGRAMDATA%\DockerDesktop\version-bin\ so only administrators and trusted service accounts can modify it.
• Audit and remove any unexpected docker-credential-wincred.exe or other binaries in that directory.
• Limit interactive admin or service-account Docker logins on hosts where low-privilege users have local access.
• Monitor for unauthorized file creation in Docker Desktop program data paths.

Detection

• Alert on creation or modification of files under %PROGRAMDATA%\DockerDesktop\version-bin\, especially docker-credential-wincred.exe.
• Monitor process creation where docker-credential-wincred.exe runs with a parent or user context inconsistent with its expected signer or path.
• Check file hashes and digital signatures of docker-credential-wincred.exe against the legitimate Docker-signed binary.
• Review Windows security logs for privilege escalation or suspicious child processes spawned from Docker Desktop components.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.