Arbitrary Code Execution in Docker
Summary
CVE-2014-6407: Arbitrary Code Execution in Docker in github.com/docker/docker. Affects github.com/docker/docker versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2014-6407 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker is a popular open-source platform that allows developers to automate the deployment and management of applications within containers. It provides an efficient and lightweight alternative to traditional virtualization. The vulnerability in question affects the GitHub repository github.com/docker/docker, which is the official Docker project written in Go.
Vulnerability Detail
The vulnerability, identified as GO-2022-0630, allows for arbitrary code execution in Docker. This means that an attacker could potentially execute malicious code within a Docker container, leading to unauthorized access, data breaches, or further compromise of the host system. The vulnerability was introduced in version 0 of the package and has been fixed in version 1.3.2.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.2
This is the first release that contains the fix.
go get github.com/docker/docker@v1.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, it is crucial to ensure that the Docker package is updated to the fixed version as soon as possible.
Conclusion
The vulnerability in Docker allows for arbitrary code execution, which can lead to unauthorized access, data breaches, and compromise of the host system. It is crucial to update the Docker package to version 1.3.2 or later to mitigate this vulnerability.
See every vulnerability recorded for github.com/docker/docker →
FAQ
Docker is an open-source platform that allows developers to automate the deployment and management of applications within containers. It provides an efficient and lightweight alternative to traditional virtualization.
Arbitrary code execution refers to the ability of an attacker to execute malicious code within a vulnerable system or application. In the case of this vulnerability, it means that an attacker could execute arbitrary code within a Docker container.
The potential ramifications of this vulnerability include unauthorized access to sensitive data, data breaches, and further compromise of the host system. It could allow an attacker to gain control over the Docker container and potentially the entire Docker environment.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
To update the Docker package, you can run the appropriate package manager command or manually update the package source code. It is recommended to update to version 1.3.2 or later.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
