Information disclosure in Docker Desktop
CVE-2025-6587
System environment variables are recorded in Docker Desktop diagnostic logs, when using shell auto-completion. This leads to unintentional disclosure of sensitive information such as api keys, passwords, etc. A malicious actor with read access to these logs could obtain secrets and further use them to gain unauthorized access to other systems. Starting with version 4.43.0 Docker Desktop no longer logs system environment variables as part of diagnostics log collection.
EPSS: 0.001 (2.8th percentile) — read the EPSS interpretation.
Affected products
- Docker Desktop — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-6587?
- CVE-2025-6587 is a vulnerability in Docker Desktop, classified under Insertion of Sensitive Information into Log File. Published 2025-07-03.
- Is CVE-2025-6587 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.