Read the docs
TI-2021-17934 Aliases CVE-2021-41092GHSA-99pg-grm5-qq3v

Docker CLI leaks private registry credentials to registry-1.docker.io

Priority LOW 36CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH.

Why it matters now

EPSS 0.01652 76th percentileScored 2026-11-07
Fix Partial cli (docker): 20.10.9github.com/docker/cli (Go): 20.10.9Red Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Dockerclibefore 20.10.920.10.9Patch availableCNA
—github.com/docker/cli (Go)before 20.10.920.10.9Patch availableGHSA-99pg-grm5-qq3v
  • cli VendorDocker Affected before 20.10.9 Fixed in 20.10.9 Patch available CNA
  • github.com/docker/cli (Go) Vendor— Affected before 20.10.9 Fixed in 20.10.9 Patch available GHSA-99pg-grm5-qq3v

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:docker:command_line_interface:*:*:*:*:*:*:*:*before 20.10.9VulnerableDocker
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
  • cpe:2.3:a:docker:command_line_interface:*:*:*:*:*:*:*:* Versions before 20.10.9 Vulnerable ·Docker
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA cli (docker) Fixed in 20.10.9
  • Fix · GHSA-99pg-grm5-qq3v github.com/docker/cli (Go) Fixed in 20.10.9 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Not affected: 7 products
  • Migration Toolkit for Virtualization
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 3
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Virtualization 2
  • Red Hat OpenShift Virtualization 4
  • Red Hat Quay 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41092
  2. 2026-10-03 Alias added: GHSA-99pg-grm5-qq3v

References

Patch 1

Advisory 4

Other 3

  • TI-2025-14197 Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability CVSS 4.0HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences