Is CVE-2026-106581 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106581 being exploited in the wild.

How severe is CVE-2026-106581?

Informational severity, published 9 October 2026.

Which products and versions are affected?

Docker Desktop for Windows before 4.92.0.

Is there a fix for CVE-2026-106581?

Yes: fixed in 4.92.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-106581 attacked?

It is attacked over the network or with local access, in a web application.

Am I affected by CVE-2026-106581?

Check whether you run Docker Desktop for Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106581: Docker Desktop for Windows package signature verification bypass

CVE-2026-106581 · Severity: info · Published 2026-10-09

Docker Desktop for Windows is a containerization platform that developers use to build and run applications. Before version 4.92.0, the installer failed to verify the digital signature of installation packages, allowing an attacker to provide a malicious package. If a user approves the installer's UAC prompt while installing a crafted package, the attacker's code executes with LocalSystem privileges, the highest privilege level on Windows.

Vendors: Docker.

Quick answers

Is CVE-2026-106581 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106581 being exploited in the wild.
How severe is CVE-2026-106581?: Informational severity, published 9 October 2026.
Which products and versions are affected?: Docker Desktop for Windows before 4.92.0.
Is there a fix for CVE-2026-106581?: Yes: fixed in 4.92.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106581 attacked?: It is attacked over the network or with local access, in a web application.
Am I affected by CVE-2026-106581?: Check whether you run Docker Desktop for Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.92.0

Technical details

The vulnerability is a signature verification bypass in Docker Desktop Installer.exe's install -package command. An attacker can supply a crafted package lacking proper signature validation; if a user approves the UAC prompt, the installer executes the attacker-controlled actions with LocalSystem privileges. This requires social engineering to convince a user to approve the prompt, but results in full system compromise.

Affected products

Docker Desktop for Windows before 4.92.0

Timeline

2026-10-09: disclosed

References

https://docs.docker.com/desktop/release-notes/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.