CVE-2025-6587: Exposure of system environment variables in Docker Desktop diagnostic logs
System environment variables are recorded in Docker Desktop diagnostic logs, when using shell auto-completion. This leads to unintentional disclosure of sensitive information such as api keys, passwords, etc. A malicious actor with read access to these logs could obtain secrets and further use them to gain unauthorized access to other systems. Starting with version 4.43.0 Docker Desktop no longer logs system environment variables as part of diagnostics log collection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Docker Desktopto a version that resolves this vulnerability.Fixed in 4.43.0 - Operational
Ensure shell auto-completion is not used to generate Docker Desktop diagnostic logs until Docker Desktop is upgraded to version 4.43.0, since system environment variables are recorded in diagnostic logs when using shell auto-completion.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6587?
CVE-2025-6587 is considered a moderate severity vulnerability due to the potential exposure of sensitive information.
How do I fix CVE-2025-6587?
To mitigate CVE-2025-6587, avoid using shell auto-completion in Docker Desktop or regularly review and secure your diagnostic logs.
What sensitive information can be exposed due to CVE-2025-6587?
CVE-2025-6587 may expose sensitive information such as API keys, passwords, and other system environment variables.
Which versions of Docker Desktop are affected by CVE-2025-6587?
CVE-2025-6587 affects Docker Desktop versions 4.43.0 and later.
How can I prevent unauthorized access to diagnostic logs related to CVE-2025-6587?
To prevent unauthorized access, ensure that only trusted personnel have access to the Docker Desktop diagnostic logs.