CVE-2025-15558: 
Docker Compose vulnerability analysis and mitigation

CVE-2025-15558 is a local privilege escalation vulnerability in Docker CLI for Windows caused by an uncontrolled search path element (CWE-427). Docker CLI searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default and can be created by low-privileged users, allowing them to plant malicious executables that run when a privileged user invokes Docker CLI plugin features. The vulnerability affects Docker CLI versions 19.03.0 through 29.1.5 and Windows binaries using the github.com/docker/cli/cli-plugins/manager package, including Docker Compose starting from v2.31.0. Non-Windows binaries and projects not using the plugin manager code are unaffected. It carries a CVSS v4.0 base score of 7.0 (High) (Github Advisory, ZDI Advisory).

The root cause is CWE-427 (Uncontrolled Search Path Element): Docker CLI's plugin manager on Windows includes %PROGRAMDATA%\Docker\cli-plugins in its plugin discovery path, a location writable by standard (low-privileged) users because ProgramData does not require elevated permissions to create subdirectories. An attacker with local low-privileged access can create this directory and place malicious binaries named after legitimate plugins (e.g., docker-compose.exe, docker-buildx.exe). When a privileged user subsequently opens Docker Desktop or invokes any Docker CLI plugin feature, the malicious binary is executed in the context of that privileged user. The fix, merged in PR #6713, removes %PROGRAMDATA%\Docker\cli-plugins from the plugin search path entirely, as it was a legacy compatibility path superseded by %ProgramFiles%\Docker\cli-plugins (Github Advisory, GitHub PR).

Successful exploitation allows a low-privileged local attacker to execute arbitrary code in the security context of a privileged user (e.g., an administrator running Docker Desktop), resulting in full compromise of confidentiality, integrity, and availability on the affected Windows system. The attacker can gain elevated privileges, access sensitive data, modify system configurations, or establish persistence. Docker Compose is also affected as a downstream consumer of the vulnerable plugin manager code starting from v2.31.0 (Github Advisory, ZDI Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability was reported to Docker by Nitesh Surana of Trend Research (TrendAI) on October 16, 2025, and publicly disclosed on March 6, 2026 via coordinated release (ZDI Advisory). The EPSS score is approximately 0.023% (7th percentile), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It is detectable by Nessus (plugin 301978) and Qualys (detection ID 761789).

1. Gain low-privileged local access: Obtain a standard (non-administrator) user account on a Windows system running Docker Desktop or Docker CLI through version 29.1.5.
2. Create the target directory: Execute mkdir C:\ProgramData\Docker\cli-plugins from the low-privileged account. This directory does not exist by default and is writable by standard users due to the permissive ACLs on C:\ProgramData.
3. Plant a malicious plugin binary: Place a crafted executable in the newly created directory, named to match a legitimate Docker CLI plugin (e.g., docker-compose.exe or docker-buildx.exe). This binary contains the attacker's payload (e.g., a reverse shell, credential dumper, or persistence mechanism).
4. Wait for privileged user interaction: The malicious binary executes automatically when a privileged user (e.g., an administrator) opens Docker Desktop or runs a Docker CLI command that triggers plugin discovery (e.g., docker compose, docker buildx).
5. Achieve privilege escalation: The payload runs in the security context of the privileged user, granting the attacker elevated access to the system (Github Advisory, ZDI Advisory).

• File System: Unexpected creation of the directory C:\ProgramData\Docker\cli-plugins\; presence of executables such as docker-compose.exe, docker-buildx.exe, or other Docker plugin-named binaries in that directory that were not placed there by a legitimate Docker installer.
• Process: Unusual child processes spawned by docker.exe or Docker Desktop.exe (e.g., cmd.exe, powershell.exe, network tools) originating from C:\ProgramData\Docker\cli-plugins\.
• Logs: Windows Security Event Log entries (Event ID 4688) showing process creation of executables from C:\ProgramData\Docker\cli-plugins\ by a privileged user; file creation events (Event ID 4663) in C:\ProgramData\Docker\ by a low-privileged account.
• Network: Unexpected outbound connections from processes launched under Docker CLI's context, particularly to external IPs shortly after Docker Desktop is opened or a Docker CLI plugin command is run.

Upgrade Docker CLI to version 29.2.0 or later, which removes %PROGRAMDATA%\Docker\cli-plugins from the plugin search path (Github Advisory, GitHub PR). Docker Compose users should upgrade to v5.1.0 or later. No official workaround is provided by the vendor; however, administrators can mitigate risk by setting restrictive ACLs on C:\ProgramData\Docker\ to prevent low-privileged users from creating subdirectories, and by auditing the C:\ProgramData\Docker\cli-plugins\ path for unauthorized files. IBM has also released patches for affected products including IBM Planning Analytics Cartridge, IBM Observability with Instana (OnPrem), and IBM Data Virtualization (IBM Advisory).

The vulnerability was discovered and reported by Nitesh Surana of Trend Research (TrendAI) and disclosed through the Zero Day Initiative program, which published advisory ZDI-26-152 on March 6, 2026 (ZDI Advisory). Red Hat tracked the issue via Bugzilla (Bug 2444574) and rated it high severity (Red Hat Bugzilla). The Docker maintainer community noted in the fix PR that the %PROGRAMDATA% path was already a legacy compatibility holdover not recommended for storing executables, and the fix was characterized as a cleanup/deprecation rather than a complex security patch (GitHub PR).