CVE-2022-2989: Docker supplementary group permissions bypass in github.com/docker/docker
Summary
CVE-2022-36109: Docker supplementary group permissions not set up properly, allowing attackers to bypass primary group restrictions in github.com/docker/docker. Affects github.com/docker/docker versions < 20.10.18+incompatible. Fixed in 20.10.18+incompatible. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2022-36109 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Docker is an open-source platform that automates the deployment, scaling, and management of applications. It allows developers to package their applications and dependencies into containers, providing a consistent environment for running software. The package 'github.com/docker/docker' is a Go library that provides a client interface for interacting with the Docker API. This vulnerability affects the way supplementary group permissions are set up in Docker, potentially allowing attackers to bypass primary group restrictions.
Vulnerability Detail
The Docker supplementary group permissions are not properly configured in the 'github.com/docker/docker' package. This oversight enables attackers to bypass primary group restrictions. By exploiting this vulnerability, an attacker could gain unauthorized access to resources or perform actions that should be restricted to certain groups. The impact of this vulnerability depends on the specific permissions and restrictions in place within the Docker environment.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
20.10.18+incompatible
This is the first release that contains the fix.
go get github.com/docker/docker@v20.10.18+incompatibleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to follow the recommended fix and update the 'github.com/docker/docker' package to the latest version.
Conclusion
The 'github.com/docker/docker' package is vulnerable to a bypass of primary group restrictions due to improper setup of supplementary group permissions. This vulnerability can be mitigated by updating the package to version 20.10.18 or later. It is important for Docker users to promptly apply the recommended fix to ensure the security of their Docker environments.
See every vulnerability recorded for github.com/docker/docker →
FAQ
Docker is an open-source platform that automates the deployment, scaling, and management of applications using containerization.
The 'github.com/docker/docker' package is a Go library that provides a client interface for interacting with the Docker API.
This vulnerability allows attackers to bypass primary group restrictions in Docker, potentially gaining unauthorized access to resources or performing restricted actions.
To fix this vulnerability, update the 'github.com/docker/docker' package to version 20.10.18 or later.
There is no specific workaround mentioned for this vulnerability. It is recommended to update the package to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
