CVE-2019-13509: Secret insertion into debug log in Docker
Summary
CVE-2019-13509: Secret insertion into debug log in Docker. Affects github.com/docker/docker versions < 18.09.8. Fixed in 18.09.8. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2019-13509 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker is an open-source platform that allows developers to automate the deployment and management of applications within containers. It provides an efficient and lightweight alternative to traditional virtual machines. Docker Engine is the core component of Docker that enables the creation and execution of containers. It offers various features and APIs for managing containerized applications. However, a vulnerability has been identified in Docker Engine that could potentially expose secrets in the debug log.
Vulnerability Detail
The vulnerability in Docker Engine occurs when running Docker in debug mode and redeploying a stack that includes secrets. In this scenario, Docker may inadvertently add secrets to the debug log. This issue also applies to other API users of the stack API if they resend the secret. The inclusion of secrets in the debug log poses a significant security risk as it could expose sensitive information to unauthorized parties. The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
18.09.8
This is the first release that contains the fix.
go get github.com/docker/docker@v18.09.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is currently no known workaround for this vulnerability. It is essential to apply the recommended fix by updating Docker to the latest version.
Conclusion
The vulnerability in Docker Engine that allows secret insertion into the debug log poses a significant security risk. It is crucial for users to update Docker to the latest version to mitigate this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/docker/docker →
FAQ
Docker is an open-source platform that allows developers to automate the deployment and management of applications within containers.
Docker Engine is the core component of Docker that enables the creation and execution of containers.
The vulnerability could expose secrets in the debug log, potentially compromising sensitive information.
To fix this vulnerability, update Docker CE and EE to version 18.09.8 or later.
No, there is currently no known workaround. It is crucial to update Docker to the latest version.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
