CVE-2025-13743: 
Docker Desktop vulnerability analysis and mitigation

CVE-2025-13743 is an information disclosure vulnerability in Docker Desktop where diagnostics bundles inadvertently include expired Docker Hub Personal Access Tokens (PATs) in log output due to improper error object serialization. The vulnerability affects Docker Desktop versions 4.51.0 through 4.53.x (fixed in 4.54.0). It was published on December 9, 2025, and carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 2.4 (Low), reflecting the local access context required for exploitation (Red Hat CVE, ENISA EUVD).

The root cause is classified as CWE-532 (Insertion of Sensitive Information into Log File). When Docker Desktop encounters access-denied errors during Hub operations, the error objects are serialized into diagnostic log bundles without properly scrubbing sensitive fields — specifically, expired Hub PATs embedded within those error objects. An attacker or unauthorized party who gains access to an exported diagnostics bundle (e.g., one shared with support) could extract these tokens. No network-level access to the target system is required; the risk materializes when a diagnostics bundle is exported and shared (Red Hat CVE, ENISA EUVD).

The primary impact is confidentiality loss: expired Docker Hub PATs are exposed within exported diagnostic bundles. While the tokens are described as expired at the time of inclusion, their presence in log files represents a sensitive information leak that could facilitate account enumeration or, in edge cases where token expiry is not enforced server-side, unauthorized access to Docker Hub resources. Integrity and availability are not directly affected by this vulnerability (Red Hat CVE).

There is no evidence of active in-the-wild exploitation of CVE-2025-13743, and no public proof-of-concept exploit code has been identified. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires access to a diagnostics bundle exported from an affected Docker Desktop instance, limiting the practical attack surface (Red Hat CVE, Tenable).

1. Obtain a diagnostics bundle: Gain access to a Docker Desktop diagnostics bundle exported from a version between 4.51.0 and 4.53.x — for example, one shared with a support team or inadvertently stored in an accessible location.
2. Extract log files: Unpack the diagnostics archive and locate the log output files contained within the bundle.
3. Search for PAT strings: Parse the log files for serialized error objects containing Docker Hub PAT patterns (typically strings matching Docker Hub token formats) that were included due to access-denied error serialization.
4. Attempt token use: Test any recovered tokens against Docker Hub APIs to determine if they remain valid despite being flagged as expired, potentially enabling unauthorized registry access (Red Hat CVE, ENISA EUVD).

• File System: Presence of Docker Desktop diagnostics bundle archives (.zip or similar) in unexpected locations or shared directories; log files within bundles containing strings matching Docker Hub PAT token patterns alongside access-denied error messages.
• Logs: Docker Desktop diagnostic log entries showing serialized error objects that include authentication token fields when access-denied errors occurred during Hub operations.

Docker has addressed this vulnerability in Docker Desktop version 4.54.0, which fixes the error object serialization to prevent PAT inclusion in diagnostic log output. Users running versions 4.51.0 through 4.53.x should upgrade to 4.54.0 or later immediately. As an interim measure, avoid sharing diagnostics bundles externally until upgraded, and revoke and rotate any Docker Hub PATs that may have been included in previously exported bundles. Review Docker's security announcements page for further guidance (Docker Security, Red Hat CVE).