Skip to content
Fencer Vulns
medium 5.4

CVE-2021-41092 json

Docker CLI leaks private registry credentials to registry-1.docker.io

published 2021-10-04 5 y ago modified 2026-10-16 23 d ago also BIT-docker-cli-2021-41092 , EUVD-2024-2000 , GHSA-99pg-grm5-qq3v , GO-2024-2912

cvss
5.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 76%
public exploits
0
none known

Summary

Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH.

Patch / fix

  • go github.com/docker/cli 20.10.9, 20.10.9+incompatible
  • bitnami docker-cli 20.10.9
  • docker command_line_interface 20.10.9
  • docker.io Debian 14, Debian 13, Debian 12 20.10.10+dfsg1-1

debian advisories DEBIAN-CVE-2021-41092

  • docker.io Ubuntu 18.04 LTS 20.10.7-0ubuntu5~18.04.3
  • docker.io Ubuntu 20.04 LTS 20.10.7-0ubuntu5~20.04.2
  • docker.io Ubuntu 22.04 LTS 20.10.7-0ubuntu7

ubuntu advisories UBUNTU-CVE-2021-41092

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • docker-stable SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +12 more 24.0.9_ce-150000.1.25.1
  • docker SLE Module for Containers 15 SP3, SLE Micro 5.1, SLE Micro 5.0 20.10.12_ce-159.1
  • containerd SLE Module for Containers 15 SP3, SLE Micro 5.1, SLE Micro 5.0 1.4.12-60.1
  • docker SLE Module for Containers 12 20.10.12_ce-98.75.1
  • containerd SLE Module for Containers 12 1.4.12-16.49.1
  • runc SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +12 more 1.0.2-23.1
  • docker SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +11 more 20.10.9_ce-156.1
  • containerd SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +11 more 1.4.11-56.1

suse advisories SUSE-SU-2025:03545-1SUSE-SU-2025:03540-1SUSE-SU-2022:0334-1SUSE-SU-2022:0213-1SUSE-SU-2021:3506-1SUSE-SU-2021:3336-1

  • docker-stable openSUSE Tumbleweed 24.0.9_ce-15.1
  • docker openSUSE Tumbleweed 20.10.9_ce-1.1
  • docker openSUSE Leap 15.3 20.10.12_ce-159.1
  • containerd openSUSE Leap 15.3 1.4.12-60.1
  • docker-kubic openSUSE Leap 15.3 20.10.12_ce-159.1
  • runc openSUSE Leap 15.2 1.0.2-lp152.2.9.1
  • docker openSUSE Leap 15.2 20.10.9_ce-lp152.2.18.1
  • containerd openSUSE Leap 15.2 1.4.11-lp152.2.12.1

opensuse advisories openSUSE-SU-2025:15589-1openSUSE-SU-2024:11566-1openSUSE-SU-2022:0334-1openSUSE-SU-2021:1404-1openSUSE-SU-2021:3506-1

  • docker Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 20.10.9-r0

alpine advisories ALPINE-CVE-2021-41092

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • docker Arch Linux 1:20.10.9-1

arch linux advisories AVG-2440

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-41092 updated cvss 7.5

docker: cli leaks private registry credentials to registry-1.docker.io

  • Red Hat Enterprise Linux 7 docker
    affected: no fix planned “Out of support scope”
  • Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-controller-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/search-rhel8, rhacm2/agent-service-rhel8, rhacm2/assisted-installer-rhel8, rhacm-assisted-service-container, rhacm2/assisted-installer-agent-rhel8, rhacm2/assisted-installer-reporter-rhel8, +2 more Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-rhel8-operator Red Hat OpenShift Container Platform 4 openshift4/cnf-tests-rhel8, openshift4/ose-helm-operator, redhat/redhat-operator-index, openshift4/ose-ansible-operator, openshift4/ose-operator-sdk-rhel9, openshift4/ose-operator-lifecycle-manager, +1 more Red Hat OpenShift Virtualization 2 vm-import-operator-container Red Hat OpenShift Virtualization 4 container-native-virtualization/vm-import-operator-rhel8
    +1 more products
    Red Hat Quay 3 quay/quay-builder-rhel8
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-22-167-09 updated cvss 5.4

Siemens SCALANCE LPE9403 Third-Party Vulnerabilities

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

1.65% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
GitHub 3.1 5.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/docker/cli
<20.10.9
<20.10.9+incompatible
20.10.9
20.10.9+incompatible
bitnami docker-cli
<20.10.9
20.10.9

Affected products

  • docker cli

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-522 Insufficiently Protected Credentials
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of docker/cli published their own advisory on GitHub. Reviewed sources take precedence over it.