PT-2025-39690 · Docker · Docker Desktop

Published 2025-09-26 · Updated 2025-09-26 · CVE-2025-10657

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Docker Desktop version 4.46.0

Description A software bug in Docker Desktop allowed the configuration for restricting commands to be ignored when passed to Enhanced Container Isolation (ECI). This granted excessive privileges by permitting unrestricted access to powerful Docker commands. The issue specifically affects users of Docker Desktop 4.46.0 with ECI enabled, and containers explicitly allowed to mount the Docker socket. The command restrictions feature, designed to limit commands issued on the Docker socket, was not functioning as intended. ECI is a security feature that enhances container isolation.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-10657

Affected Products

Docker Desktop

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-10657 · Security Note
• https://twitter.com/CVEnew/status/1971688028725723441 · Twitter Post
• https://docs.docker.com/desktop/release-notes · Note
• https://twitter.com/CveFindCom/status/1971691093545701758 · Twitter Post
• https://t.me/CVEtracker/33503 · Telegram Post