{"id":"CVE-2026-106581","title":"Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package","summary":"Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed…","severity":"high","cwe":["CWE-347"],"published":"2026-10-09","updated":"2026-10-09","sourceUpdated":"2026-10-09T17:16:45.270","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106581","references":[{"url":"https://docs.docker.com/desktop/release-notes/#4920","label":"security@docker.com"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-10-09T15:00:31.364Z","epss":0.00075,"epssPercentile":0.00081,"vendor":"Docker","product":"Docker Desktop","affected":["desktop < 4.92.0"],"cvss":8.2,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-09T16:16:16.621716Z"},"cvssSource":"cna","slug":"CVE-2026-106581","body":"## Overview\n\nBefore 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer actions as LocalSystem.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":220602,"id":"CVE-2026-106581","ts":1792022830472,"field":"cvss","old":null,"new":"8.2"},{"seq":220601,"id":"CVE-2026-106581","ts":1792022830472,"field":"severity","old":"none","new":"high"}]}