CVE-2021-3162
7.8 HIGHDocker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation
Published: 2021-01-15 · Last updated: 2026-06-17
Severity and scoring
- CVSS
- 7.8 HIGH
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-295
Affected products
| Vendor | Product |
|---|---|
| docker | docker |
Description
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-3162
- [Vendor advisory]https://docs.docker.com/docker-for-mac/release-notes/#docker-desktop-community-2500
- [Other]https://twitter.com/_r3ggi
- [Vendor advisory]https://docs.docker.com/docker-for-mac/release-notes/#docker-desktop-community-2500
- [Other]https://twitter.com/_r3ggi
Related CVEs
Same vendor
- CVE-2026-42306 — Moby is an open source container framework (7.2 HIGH)
- CVE-2026-41568 — Moby is an open source container framework (6.1 MEDIUM)
- CVE-2026-5843 — The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary P... (8.2 HIGH)
- CVE-2026-5817 — The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizer... (8.2 HIGH)
- CVE-2026-6406 — The Docker CLI --use-api-socket flag bypasses Enhanced Container Isolation (ECI) restrictions in Docker Desktop (8.8 HIGH)
Same CWE
- CVE-2025-71261 — An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere... (8.6 HIGH)
- CVE-2026-9259 — Improper validation of server certificates in Canon EOS Network Setting Tool Version 1.5.0 or earlier (6.5 MEDIUM)
- CVE-2026-9258 — Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier (6.5 MEDIUM)
- CVE-2026-45388 — In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate provided by the server, which allows imp... (9.1 CRITICAL)
- CVE-2026-45170 — Idira Privilege Cloud Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS certificate validati...