CVE-2025-3911: 
Docker Desktop vulnerability analysis and mitigation

Recording of environment variables, configured for running containers, in Docker Desktop application logs could lead to unintentional disclosure of sensitive information such as API keys and passwords. The vulnerability was discovered and disclosed on April 29, 2025, affecting Docker Desktop installations across all supported platforms. The issue has been assigned CVE-2025-3911 and has been fixed in Docker Desktop version 4.41.0 (NVD, Wiz).

The vulnerability involves the unintentional logging of container environment variables in Docker Desktop application logs. These logs could contain sensitive information such as API keys and passwords. The issue has been assigned CWE-532 (Insertion of Sensitive Information into Log File) and received a CVSS 4.0 Base Score of 5.2 (MEDIUM) with the vector string CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H (NVD).

If exploited, this vulnerability could lead to the disclosure of sensitive credentials information. A malicious actor with read access to the Docker Desktop application logs could obtain sensitive information such as API keys and passwords, potentially leading to unauthorized access to other systems (NVD).

The vulnerability has been patched in Docker Desktop version 4.41.0. In this version, Docker Desktop no longer logs environment variables set by the user. Users are advised to upgrade to version 4.41.0 or later to address this security issue (NVD, Docker Docs).