PT-2025-27769 · Docker · Docker Desktop
Published
2025-07-03
·
Updated
2025-07-03
·
CVE-2025-6587
CVSS v4.0
5.2
Medium
| Vector | AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H |
Name of the Vulnerable Software and Affected Versions:
Docker Desktop versions prior to 4.43.0
Description:
The issue concerns the recording of system environment variables in Docker Desktop diagnostic logs when using shell auto-completion. This leads to the unintentional disclosure of sensitive information, such as API keys and passwords. A malicious actor with read access to these logs could obtain secrets and use them to gain unauthorized access to other systems.
Recommendations:
For versions prior to 4.43.0, update to version 4.43.0 or later to prevent system environment variables from being logged as part of diagnostics log collection. As a temporary workaround, consider restricting access to the diagnostic logs to minimize the risk of exploitation. Avoid using shell auto-completion in Docker Desktop until the issue is resolved.
Fix
Insertion into Log File
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Docker Desktop