CVE-2021-41092

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200CWE-522

Affected software

No affected versions have been published.

Timeline

Published
Oct 4, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-410939.8Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an acCVE-2021-410944.6Wire is an open source secure messenger. Users of Wire by Bund may bypass the mandatory encryption at rest feature by simply disabling theirCVE-2021-410956.1Discourse is an open source discussion platform. There is a cross-site scripting (XSS) vulnerability in versions 2.7.7 and earlier of the `sCVE-2021-410967.5Rucky is a USB HID Rubber Ducky Launch Pad for Android. Versions 2.2 and earlier for release builds and versions 425 and earlier for nightlyCVE-2021-410977.5aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aCVE-2021-410987.5Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on CVE-2021-410997.5Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the underlying string library can be used to cCVE-2021-41107.5mruby is vulnerable to NULL Pointer DereferenceCVE-2021-411009.8Wire-server is the backing server for the open source wire secure messaging application. In affected versions it is possible to trigger emaiCVE-2021-411015.7wire-server is an open-source back end for Wire, a secure collaboration platform. Before version 2.106.0, the CORS ` Access-Control-Allow-OrCVE-2021-411037.8containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd wheCVE-2021-411047.5ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older