# CVE-2019-13509: docker — Fixed in 18.09.8

🐹

🐹 Go

Not in CISA KEV

HIGH severity

# CVE-2019-13509 — docker

HIGH 

CVE-2019-13509 is a high-severity (CVSS 7.5) CWE-532 vulnerability in github.com/docker/docker. A fix is available for github.com/docker/docker — see the affected versions and patch details below.

Secret insertion into debug log in Docker

Also known as[GHSA-j249-ghv5-7mxv](/vulnerability/GHSA-j249-ghv5-7mxv)

Published

Jul 18, 2019

Updated

Oct 24, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Nov 5, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

3.7%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs90th percentile — riskier than 90% of all scored CVEsHighest risk

0.88%2.02%3.16%4.29%1.6%3.7%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## How urgent is this, really

## Where this sits among everything scored

## Real-World Exposure

1 pkg affected

🐹`github.com/docker/docker`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

## Description

In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret.

## Affected Packages

1 total 1 fixed

Ecosystem

Package

Vulnerable range

Fix

🐹Go

`github.com/docker/docker` 

all versions

18.09.8`go get github.com/docker/docker@v18.09.8`

## Affected Products

1 product · 40 configurations

Application

`docker`docker

≥ 18.09.0 && < 18.09.8

3 versions

17.03.217.06.218.03.1

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/docker/docker, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update github.com/docker/docker to 18.09.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2019-13509 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
    

## Frequently Asked Questions

In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret.

O3 Security · Impact-Aware SCA

### Is CVE-2019-13509 in your dependencies?

Find it across Go, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)