Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Docker CLI --use-api-socket flag bypasses Enhanced Container Isolation (ECI) restrictions in Docker Desktop. When ECI is enabled, Docker socket mounts from containers are denied unless explicitly allowed via the admin-settings configuration. However, the --use-api-socket flag adds the Docker socket mount via the HostConfig.Mounts field rather than the HostConfig.Binds field. The ECI enforcement in the Docker Desktop API proxy only inspected Binds, allowing the mount to pass unchecked. This grants a container full access to the Docker Engine socket and, if the host user has logged in to container registries, their authentication credentials. A local attacker with the ability to run Docker CLI commands can exploit this to escape ECI restrictions, access the Docker Engine, and potentially escalate privileges.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 4 products
| Date | Total | Labels |
|---|
| 2026-04-24 | 1 | Disclosure1 |
| 2026-04-26 | 1 | Disclosure1 |
| 2026-05-23 | 2 | Disclosure2 |
[ZDI-26-299|CVE-2026-6406] Docker Desktop Enhanced Container Isolation Exposed Dangerous Function Local Privilege Escalation Vulnerability (CVSS 8.8; Credit: Nitesh Surana (http://niteshsurana.com) of Trend Research) https://www.zerodayinitiative.com/advisories/ZDI-26-299/
Post summary
The advisory announces CVE‑2026‑6406, a Local Privilege Escalation flaw in Docker Desktop’s Enhanced Container Isolation, rated CVSS 8.8.
🚨*CVE* CVE-2026-6406 The Docker CLI --use-api-socket flag bypasses Enhanced Container Isolation (ECI) restrictions in Docker Desktop. When ECI is enabled, Docker socket mounts from containe… https://www.cve.org/CVERecord?id=CVE-2026-6406 ----- Traducción: CVE-2026-6406 La … http://infoflow.cloud`
Post summary
The tweet discloses CVE-2026-6406, describing how the Docker CLI flag bypasses ECI restrictions, but provides no PoC, exploit code, patch, or evidence of active exploitation.
CVE-2026-6406 The Docker CLI --use-api-socket flag bypasses Enhanced Container Isolation (ECI) restrictions in Docker Desktop. When ECI is enabled, Docker socket mounts from containe… https://www.cve.org/CVERecord?id=CVE-2026-6406
Post summary
CVE‑2026‑6406 is disclosed as a Docker Desktop flaw where the '--use-api-socket' flag bypasses Enhanced Container Isolation, allowing Docker socket mounts when ECI is enabled.
Docker Desktop Enhanced Container Isolation Exposed Dangerous Function Local Privilege Escalation Vulnerability (CVE-2026-6406) #CVE20266406 #CyberSecurity #Docker #LocalPrivilegeEscalation https://www.systemtek.co.uk/?p=50814 https://t.co/oVQxeOPEpd
Post summary
The post announces a local privilege escalation vulnerability (CVE‑2026‑6406) affecting Docker Desktop’s enhanced container isolation.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | apple | macos | - | - | - |
| App | docker | docker_desktop | - | - | - |
| OS | linux | linux_kernel | - | - | - |
| OS | microsoft | windows | - | - | - |