CVE-2025-15558 — Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Affected: Docker CLI, Docker Compose, Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2, Red Hat Builds for Red Hat OpenShift, Red Hat Gatekeeper 3, Red Hat Kernel Module Management Operator for Red Hat Openshift, Red Hat Machine Deletion Remediation Operator, Red Hat Multicluster Engine for Kubernetes, Red Hat Multicluster Global Hub, Red Hat OpenShift Pipelines and 19 more

Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user.

This issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/cli@v29.1.5+incompatible/cli-plugins/manager package, such as Docker Compose.

This issue does not impact non-Windows binaries, and projects not using the plugin-manager code.

GHSA-3fxj-6jh8-hvhx — chi Has an IP Spoofing Vulnerability in `middleware.RealIP`

Affected: Go: github.com/go-chi/chi/v5/middleware

## Summary The `RealIP` middleware in `go-chi/chi` is vulnerable to IP spoofing because it blindly trusts the first (leftmost) element of the `X-Forwarded-For` HTTP header. This allows a remote attacker to bypass IP-based access control lists (ACLs) and rate-limiting mechanisms by providing a spoofed IP address in the header.

## Details In `middleware/realip.go`, the `realIP` function parses the `X-Forwarded-For` header and extracts the first comma-separated value:

```go func realIP(r *http.Request) string { // ... } else if xff := r.Header.Get(xForwardedFor); xff != "" { ip, _, _ = strings.Cut(xff, ",") } // ... } ```

Standard practice for `X-Forwarded-For` is that each proxy appends the client's IP to the end of the list. However, since the client can also provide this header, the leftmost values are untrusted. A client can send a header like `X-Forwarded-For: <spoofed_ip>, <actual_proxy_ip>`, and `go-chi/chi` will treat `<spoofed_ip>` as the source of the request.

## Proof of Concept (PoC) The following code demonstrates how an attacker can bypass an IP-based restriction.

```go package main

import ( "fmt" "net/http" "net/http/httptest"

"github.com/go-chi/chi/v5" "github.com/go-chi/chi/v5/middleware" )

func main() { r := chi.NewRouter()

// Enable the vulnerable RealIP middleware r.Use(middleware.RealIP)

// An endpoint that should be restricted to a specific administrat…

Most recent entries from all

CVE-2025-15558 — Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

GHSA-3fxj-6jh8-hvhx — chi Has an IP Spoofing Vulnerability in `middleware.RealIP`