CVE-2025-3911: Docker Desktop Information Disclosure Flaw

CVE-2025-3911 Overview

CVE-2025-3911 is an Information Leakage vulnerability in Docker Desktop that results from the recording of environment variables configured for running containers in application logs. This logging behavior could lead to unintentional disclosure of sensitive information such as API keys, passwords, and other credentials.

A malicious actor with read access to these logs could obtain sensitive credentials information and further use it to gain unauthorized access to other systems. This vulnerability is classified under CWE-532 (Insertion of Sensitive Information into Log File), highlighting the risk of logging secrets in plaintext.

Critical Impact

Sensitive credentials including API keys, passwords, and authentication tokens may be exposed through Docker Desktop application logs, potentially enabling lateral movement and unauthorized access to connected systems.

Affected Products

• Docker Desktop versions prior to 4.41.0

Discovery Timeline

• 2025-04-29 - CVE CVE-2025-3911 published to NVD
• 2025-05-02 - Last updated in NVD database

Technical Details for CVE-2025-3911

Vulnerability Analysis

This vulnerability stems from Docker Desktop's logging mechanism, which captured environment variables passed to running containers without proper sanitization. Environment variables are commonly used in containerized applications to pass configuration data, including sensitive credentials like database passwords, API keys, and authentication tokens. When these variables are written to application logs in plaintext, they become accessible to anyone with read permissions on the log files.

The attack requires local access to the system where Docker Desktop is installed, specifically to the application log files. An attacker who compromises a developer workstation or gains access to shared development environments could extract these credentials from the logs and use them for further attacks.

Root Cause

The root cause of this vulnerability is the improper handling of sensitive data in the logging subsystem of Docker Desktop. The application logged environment variable values without implementing proper redaction or filtering mechanisms for potentially sensitive content. This is a common oversight in software development where logging verbosity during debugging may inadvertently capture secrets.

Attack Vector

The attack vector is local, requiring an adversary to have read access to the Docker Desktop log files on the target system. Potential attack scenarios include:

• An insider threat with legitimate system access reviewing log files
• An attacker who has gained initial foothold on a developer workstation through phishing or other means
• Shared development environments where multiple users have access to log directories
• Log aggregation systems that collect and store Docker Desktop logs centrally

The vulnerability requires attackers to parse log files to extract environment variable values containing sensitive credentials, which they can then leverage for unauthorized access to other systems referenced in those credentials.

Detection Methods for CVE-2025-3911

Indicators of Compromise

• Unusual access patterns to Docker Desktop log file locations
• Evidence of log file reading by unauthorized processes or users
• Access to log files from unexpected user accounts or at unusual times
• Signs of credential reuse or unauthorized access to systems whose credentials were stored in container environment variables

Detection Strategies

• Monitor file access events on Docker Desktop log directories using endpoint detection tools
• Implement file integrity monitoring on log file locations to detect unauthorized access
• Review authentication logs for signs of credential abuse that may indicate extracted secrets are being used
• Enable auditing on log file directories to track which users and processes access these files

Monitoring Recommendations

• Configure SentinelOne to monitor for suspicious access to Docker Desktop log file paths (typically located in ~/Library/Containers/com.docker.docker/Data/log/ on macOS and %APPDATA%\Docker\log\ on Windows)
• Implement behavioral analysis to detect anomalous file access patterns by non-Docker processes
• Set up alerts for bulk log file reads that may indicate credential harvesting attempts

How to Mitigate CVE-2025-3911

Immediate Actions Required

• Upgrade Docker Desktop to version 4.41.0 or later, which no longer logs environment variables set by users
• Review existing Docker Desktop log files for exposed credentials and rotate any potentially compromised secrets
• Implement proper secrets management solutions instead of passing sensitive data via environment variables
• Restrict file system permissions on Docker Desktop log directories to limit access

Patch Information

Docker has addressed this vulnerability in Docker Desktop version 4.41.0. Starting with this version, Docker Desktop no longer logs environment variables set by the user, preventing the unintentional disclosure of sensitive information. Users should update to version 4.41.0 or later to remediate this vulnerability. Additional details can be found in the Docker Troubleshooting Guide.

Workarounds

• Use Docker secrets or mounted secret files instead of environment variables for passing sensitive configuration data
• Implement strict file system permissions on Docker Desktop log directories to prevent unauthorized access
• Regularly purge old log files that may contain sensitive information
• Consider using a secrets management solution like HashiCorp Vault to inject credentials at runtime without environment variables

# Restrict log directory permissions (Linux/macOS example)
chmod 700 ~/Library/Containers/com.docker.docker/Data/log/

# Purge existing logs that may contain sensitive data
rm -f ~/Library/Containers/com.docker.docker/Data/log/*.log

# Verify Docker Desktop version
docker --version
# Ensure version is 4.41.0 or higher