CVE-2025-6587CWE-532

Exposure of system environment variables in Docker Desktop diagnostic logs

Medium · published July 3, 2025

CVSS v4.0
5.2
EPSS
0%
Percentile
3.5
In the wild
Unconfirmed
What it is

System environment variables are recorded in Docker Desktop diagnostic logs, when using shell auto-completion. This leads to unintentional disclosure of sensitive information such as api keys, passwords, etc.

A malicious actor with read access to these logs could obtain secrets and further use them to gain unauthorized access to other systems. Starting with version 4.43.0 Docker Desktop no longer logs system environment variables as part of diagnostics log collection.

The record
Technical detail
CVSS v4.0
5.2 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
EPSS
0.00146 · 3.5th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2025-07-03T10:03Z
EPSS history
Timeline
  • 03 JUL 10:03Z
    Exposure of system environment variables in Docker Desktop diagnostic logs
    cvelistv5