CVE-2024-6222 is a high severity flaw in Docker Desktop before 4.29.0, scored 7.0. An attacker who has already broken out of a container into the Docker Desktop VM can escape further to the host through extension and dashboard IPC messages. Docker fixed it in 4.29.0 and changed a default in 4.31.0.
What's affected
The record says Docker Desktop before v4.29.0 is affected. Per the Docker text in the record, 4.29.0 fixes the issue on macOS, Linux and Windows with the Hyper-V backend. Docker then changed the default configuration in 4.31.0 so that "Allow only extensions distributed through the Docker Marketplace" is enabled by default.
That setting matters because the record states exploitation requires it to be disabled. So the exposure is a combination of an old version and a relaxed extensions policy. The weakness is CWE-923, improper restriction of communication channels to intended endpoints.
Note the scope of the fix statement: it names macOS, Linux and Windows with Hyper-V. It does not say anything in the record about other Windows backends, so read the 4.29.0 section of the Docker Desktop release notes if you run a different one.
This is a second stage issue. The attacker first needs a container breakout into the VM, which is itself a serious precondition. The record does not report exploitation, and the KEV flag is false.
How to check if you're exposed
Open Docker Desktop and read the version from the About dialog, or from the command line:
docker version
The Server section reports the engine, and the Docker Desktop version appears in the Desktop About screen. Anything below 4.29.0 is affected, and anything below 4.31.0 lacks the stricter default.
Then check the setting. In Settings, under Extensions, see whether "Allow only extensions distributed through the Docker Marketplace" is turned on. Organizations that manage Docker Desktop centrally can enforce the value with their admin controls, which is better than relying on each developer.
What to do now
- Upgrade Docker Desktop to 4.31.0 or later on every developer machine and build host.
- Turn on the option that allows only Marketplace extensions, and lock it if you use managed settings.
- Review which extensions are installed and remove any you do not recognise.
- Treat container breakouts as the real risk. Keep base images patched, drop unneeded capabilities and avoid running untrusted images.
- Scan the images your team runs so a poisoned or outdated image is caught before it starts.
Why it matters
Container isolation is a layered promise. The VM that hosts Docker Desktop is the second layer, and the host operating system is the third. This flaw weakens the boundary between the second and the third, because the VM could talk to a privileged component over IPC in a way that was not properly limited.
Developer laptops are attractive because they hold source code, cloud credentials and signing keys. A path from a container to the host is worth closing even when it needs a precondition.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need the 4.31.0 release or is 4.29.0 enough?
4.29.0 carries the fix for the listed platforms. 4.31.0 also turns on the Marketplace only extensions setting by default, so it is the better target.
Is this exploited in the wild?
The record does not say so and the KEV flag is false.
Sources
- Docker Desktop release notes
- NVD record for CVE-2024-6222, as held in the batch record file
Last reviewed: 19 October 2026.
