CVE-2025-9074

Name of the Vulnerable Software and Affected Versions Docker Desktop versions prior to 4.44.3

Description A critical vulnerability exists in Docker Desktop that allows local Linux containers to access the Docker Engine API via the configured Docker subnet, defaulting to 192.168.65.7:2375. This issue occurs regardless of Enhanced Container Isolation (ECI) being enabled or disabled, and even with the "Expose daemon on tcp://localhost:2375 without TLS" option enabled. Successful exploitation can lead to the execution of privileged commands on the engine API, including control over other containers, creation of new containers, and management of images. In certain scenarios, specifically Docker Desktop for Windows with a WSL backend, it also permits mounting the host drive with the same privileges as the user running Docker Desktop. The root cause is an unauthenticated HTTP API accessible from within any container. This vulnerability is rated as critical with a CVSS score of 9.3.

Recommendations Update Docker Desktop to version 4.44.3 or later.