A high-severity path traversal vulnerability was found in Docker Compose's support for OCI artifacts, allowing attackers to write arbitrary files on the host system. This flaw could be triggered by running commands like "docker compose ps" with malicious Compose files, potentially leading to unauthorized access. Users are urged to upgrade to Docker version v2.40.2 or later to mitigate the issue.

Researchers revealed a serious security flaw in Docker's Ask Gordon AI that allowed attackers to execute code and steal sensitive data. The vulnerability, called DockerDash, exploited unverified metadata in Docker images, which the AI treated as executable commands. Docker has fixed the issue in version 4.50.0.

Docker has addressed a critical vulnerability identified as CVE-2025-9074 that could allow unauthorized access to sensitive information. Users are encouraged to update their Docker installations to mitigate potential security risks associated with this flaw.

Docker has introduced Docker Hardened Images (DHI), which are secure-by-default container images that significantly reduce the attack surface and streamline software supply chain security. These images, designed for modern production environments, are continuously updated, minimize vulnerabilities, and integrate seamlessly into existing workflows without sacrificing flexibility or usability.