Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Docker CLI may send private login details to Docker Hub

CVE-2021-41092 · published 5 years ago
Summary

The Docker command-line tool can mistakenly forward your username and password for a private container registry to Docker's public registry if the helper program settings are wrong. This could expose sensitive credentials. Update Docker to version 20.10.9 or later, or make sure any credential helper entries in your configuration point to a valid, executable program.

What to do
  • Update github.com docker to version 20.10.9.
  • Update docker-cli to version 20.10.9.
  • Update debian docker.io to version 20.10.10+dfsg1-1.
  • Update docker command_line_interface to version 20.10.9 or later.
Affected software
Ecosystem VendorProductAffected versions
go github.com docker < 20.10.9
Fix: upgrade to 20.10.9
– docker command_line_interface < 20.10.9
cpe:2.3:a:docker:command_line_interface:*:*:*:*:*:*:*:*
– fedoraproject fedora 34
35
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Bitnami – docker-cli < 20.10.9
Fix: upgrade to 20.10.9
Debian:12 debian docker.io < 20.10.10+dfsg1-1
Fix: upgrade to 20.10.10+dfsg1-1
Original advisory text
Docker CLI leaks private registry credentials to registry-1.docker.io
Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-200Information Exposure
CWE-522Insufficiently Protected Credentials
Timeline
Published4 Oct 2021
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-99pg-grm5-qq3v · GHSA
CVE-2021-41092 · NVD
BIT-docker-cli-2021-41092 · OSV
DEBIAN-CVE-2021-41092 · OSV
Track software like this
Free during beta