Sensitive Information Exposure in Docker Desktop Diagnostics from Docker
CVE-2025-13743

2.4LOW

Key Information:

Vendor

Docker

Status
Docker Desktop
Vendor
CVE Published:
9 December 2025

What is CVE-2025-13743?

A vulnerability in Docker Desktop allows sensitive information, including expired Personal Access Tokens (PATs), to be unintentionally exposed in the diagnostic logs. This issue arises due to improper serialization of error objects, which may occur when access is denied on certain operations. Consequently, users could unintentionally disclose sensitive data during troubleshooting, particularly when interacting with logs generated during diagnostics. It is essential for users to be aware of this potential exposure when handling diagnostic information.

Affected Version(s)

Docker Desktop Windows 4.51.0 < 4.54.0

References

https://docs.docker.com/desktop/troubleshoot-and-support/...

CVSS V4

Score:
2.4
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.