CVE-2025-15558

Fixed in a distro release EPSS <1%CVSS 7.0

Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user. This issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/cli@v29.1.5+incompatible/cli-plugins/manager  package, such as Docker Compose. This issue does not impact non-Windows binaries, and projects not using the plugin-manager code.

Published 2026-03-04 · CVE record · OSV

Products: Docker CLI, Docker Compose, Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, Red Hat Gatekeeper 3, Kernel Module Management Operator for Red Hat Openshift, Red Hat Machine Deletion Remediation Operator, Red Hat Multicluster Engine for Kubernetes, Red Hat Multicluster Global Hub, Red Hat OpenShift Pipelines, Red Hat OpenShift Serverless, Red Hat OpenShift Service Mesh 2, Red Hat OpenShift Service Mesh 3, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Advanced Cluster Security 4, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces, Red Hat OpenShift for Windows Containers, Red Hat OpenShift GitOps, Red Hat OpenShift Virtualization 4, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0, Red Hat Quay 3, Red Hat Trusted Artifact Signer, Red Hat Security Profiles Operator, Red Hat Zero Trust Workload Identity Manager, Red Hat Zero Trust Workload Identity Manager - Tech Preview

Fixed upstream

Distro releases