PT-2025-39690
CVE-2025-10657
·
Published
2025-09-26
·
Updated
2026-10-09
Description by
CVSS 4.0
8.7
HighMetricsAV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Docker Desktop version 4.46.0
Description
A software bug in Docker Desktop allowed the configuration for restricting commands to be ignored when passed to Enhanced Container Isolation (ECI). This granted excessive privileges by permitting unrestricted access to powerful Docker commands. The issue specifically affects users of Docker Desktop 4.46.0 with ECI enabled, and containers explicitly allowed to mount the Docker socket. The command restrictions feature, designed to limit commands issued on the Docker socket, was not functioning as intended. ECI is a security feature that enhances container isolation.
Recommendations
Update to a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾