A vulnerability in the Docker CLI allows local attackers to bypass Enhanced Container Isolation, potentially leading to a full compromise of the container environment.

This is an incorrect authorization vulnerability (CWE-863) where the --use-api-socket flag permits a local user with low privileges to circumvent security isolation mechanisms in Docker Desktop.

Successful exploitation allows an attacker to break out of intended container isolation boundaries, potentially leading to unauthorized access to the host system or other containers. Given the CVSS score of 8.8, this represents a significant risk to the integrity and confidentiality of the development and production environments, necessitating prioritized remediation.

Immediate Action: Update Docker Desktop to version 4.59.0 or later as specified in the vendor release notes.

Proactive Monitoring: Review local host access logs and container management logs for suspicious usage of the --use-api-socket flag by unauthorized service accounts or users.

Compensating Controls: Restrict access to the Docker CLI to authorized personnel only and implement robust host-level monitoring to detect unauthorized attempts to escalate privileges within the container runtime environment.

Public Exploit Available: No (exploit_available: false)

The risk posed by this authorization bypass is severe for environments relying on ECI for security segmentation. Organizations should treat this as a high-priority update and ensure all Docker Desktop installations are patched to version 4.59.0 to restore the integrity of the container isolation model.