CVE-2025-6587
mediumpriority · track · 0EPSS 0.001 · 4 %ileDEEURUEPSS · scored 2026-10-27
System environment variables are recorded in Docker Desktop diagnostic logs, when using shell auto-completion. This leads to unintentional disclosure of sensitive information such as api keys, passwords, etc. A malicious actor with read access to these logs could obtain secrets and further use them to gain unauthorized access to other systems. Starting with version 4.43.0 Docker Desktop no longer logs system environment variables as part of diagnostics log collection.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.3–6.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2025-1457Docker Desktop: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2025-07-03csaf · cert_bundDE
Ein lokaler Angreifer kann eine Schwachstelle in Docker Desktop ausnutzen, um Informationen offenzulegen.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
- https://docs.docker.com/desktop/troubleshoot-and-support/troubleshoot/#check-the-logscnnvd
- https://vigilance.fr/vulnerability/Docker-Desktop-logged-sensitive-information-via-Diagnostic-Environment-Variables-47614cnnvd
- https://docs.docker.com/desktop/troubleshoot-and-support/troubleshoot/#check-the-logsenisa_euvd
- https://docs.docker.com/desktop/troubleshoot-and-support/troubleshoot/#check-the-logsnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan