CVE-2025-13743
📋 TL;DR
Docker Desktop diagnostics bundles inadvertently include expired Personal Access Tokens (PATs) in log output due to error object serialization issues. This vulnerability allows sensitive credential leakage when diagnostics are exported, particularly affecting users who generate troubleshooting bundles after encountering access denied errors.
💻 Affected Systems
- Docker Desktop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Expired PATs could be recovered and potentially used to gain unauthorized access to Docker Hub repositories if tokens were still valid or if similar patterns reveal current tokens.
Likely Case
Sensitive credentials exposed in diagnostic logs could be accessed by unauthorized personnel or attackers with access to exported diagnostic files.
If Mitigated
With proper access controls and log sanitization, the risk is limited to authorized personnel who handle diagnostic bundles.
🎯 Exploit Status
Exploitation requires access to exported diagnostic bundles, which are typically generated by authorized users for troubleshooting purposes.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Docker Desktop release notes for specific version
Vendor Advisory: https://docs.docker.com/desktop/troubleshoot-and-support/troubleshoot/#troubleshoot-menu
Restart Required: Yes
Instructions:
1. Open Docker Desktop
2. Check for updates in Settings
3. Install the latest version
4. Restart Docker Desktop
🔧 Temporary Workarounds
Disable diagnostics export
allPrevent generation of diagnostics bundles that may contain sensitive information
Manual log sanitization
allManually review and redact sensitive information from diagnostic bundles before sharing
🧯 If You Can't Patch
- Restrict access to diagnostic bundles to authorized personnel only
- Implement strict access controls on directories containing diagnostic files
🔍 How to Verify
Check if Vulnerable:
Check Docker Desktop version against patched version in release notesCheck Version:
docker --versionVerify Fix Applied:
Update to latest version and verify diagnostics no longer contain PATs in error logs📡 Detection & Monitoring
Log Indicators:
- Diagnostic bundles containing 'pat_' strings or Docker Hub authentication tokens in log files
Network Indicators:
- Unauthorized Docker Hub API calls using leaked tokens
SIEM Query:
Search for 'pat_' OR 'docker.io' token patterns in log files and diagnostic archives