GO-2024-2912 Docker CLI leaks private registry credentials to registry-1.docker.io in github.com/docker/cli

🗓️ 01 Jul 2024 21:50:42Reported by GoogleType

osv

osv🔗 osv.dev👁 32 Views

Docker CLI leaks private registry credentials to registry-1.docker.io

Reporter	Title	Published	Views	Family All 118
IBM Security Bulletins	Security Bulletin: A vulnerability in Docker CLI affects IBM Cloud Pak System (CVE-2021-41092)	6 May 202218:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	8 Jun 202321:56	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in the Linux Kernel, Docker, Python, and NGINX affect IBM Spectrum Protect Plus	10 Dec 202118:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security is vulnerable to Using Components with Known Vulnerabilities	25 Jul 202213:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Discover is vulnerable to Docker CLI (CVE-2021-41092) and Apache Log4j (CVE-2021-4104, CVE-2022-23302, CVE-2022-23305, CVE-2022-23307) weaknesses	18 Aug 202221:26	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak	20 Aug 202218:29	–	ibm
Tenable Nessus	Amazon Linux 2 : docker (ALAS-2022-017) (deprecated)	8 Mar 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2 : docker (ALASDOCKER-2022-017)	2 May 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2 : docker (ALASECS-2023-028)	17 Nov 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : docker (ALASNITRO-ENCLAVES-2022-017)	11 May 202200:00	–	nessus

Source	Link
github	www.github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v
github	www.github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b

22 Feb 2026 22:55Current

7.4High risk

Vulners AI Score7.4

CVSS 25

CVSS 3.15.4 - 7.5

EPSS0.00077

docker cli private registry credentials registry-1.docker.io github.com/docker/cli software