CVE-2025-1696: Exposure of Proxy Credentials in Docker Desktop Logs
First published: Thu Mar 06 2025(Updated: )
A vulnerability exists in Docker Desktop prior to version 4.39.0 that could lead to the unintentional disclosure of sensitive information via application logs. In affected versions, proxy configuration data—potentially including sensitive details—was written to log files in clear text whenever an HTTP GET request was made through a proxy. An attacker with read access to these logs could obtain the proxy information and leverage it for further attacks or unauthorized access. Starting with version 4.39.0, Docker Desktop no longer logs the proxy string, thereby mitigating this risk.
Credit: security@docker.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Docker | <4.39.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-1696?
CVE-2025-1696 is considered a medium severity vulnerability due to the risk of sensitive information disclosure.
How can I mitigate CVE-2025-1696?
To mitigate CVE-2025-1696, upgrade Docker Desktop to version 4.39.0 or later to prevent sensitive data from being logged.
What information is at risk in CVE-2025-1696?
CVE-2025-1696 could lead to the exposure of proxy configuration data, which may include sensitive details like authentication tokens.
What versions of Docker Desktop are affected by CVE-2025-1696?
Docker Desktop versions prior to 4.39.0 are affected by CVE-2025-1696.
Is there any remediation for CVE-2025-1696 besides upgrading?
While upgrading is the primary remediation, ensure that log files are monitored and managed securely to prevent data exposure.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/title
- agent/description
- agent/first-publish-date
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/source
- agent/severity
- agent/tags
- agent/author
- agent/event
- vendor/docker
- canonical/docker