Docker Desktop 4.46.0 Enhanced Container Isolation privileges management

Summaryinfo

A vulnerability was found in Docker Desktop 4.46.0. It has been classified as critical. This affects an unknown part of the component Enhanced Container Isolation. Performing a manipulation results in privileges management. This vulnerability was named CVE-2025-10657. The attack needs to be approached locally. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as critical, was found in Docker Desktop 4.46.0. This affects an unknown code block of the component Enhanced Container Isolation. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In a hardened Docker environment, with Enhanced Container Isolation ( ECI https://docs.docker.com/enterprise/security/hardened-desktop/enhanced-container-isolation/ ) enabled, an administrator can utilize the command restrictions feature https://docs.docker.com/enterprise/security/hardened-desktop/enhanced-container-isolation/config/#command-restrictions  to restrict commands that a container with a Docker socket mount may issue on that socket. Due to a software bug, the configuration to restrict commands was ignored when passed to ECI, allowing any command to be executed on the socket. This grants excessive privileges by permitting unrestricted access to powerful Docker commands. The vulnerability affects only Docker Desktop 4.46.0 users that have ECI enabled and are using the Docker socket command restrictions feature. In addition, since ECI restricts mounting the Docker socket into containers by default, it only affects containers which are explicitly allowed by the administrator to mount the Docker socket.

It is possible to read the advisory at docs.docker.com. This vulnerability is uniquely identified as CVE-2025-10657 since 09/17/2025. The exploitability is told to be easy. Attacking locally is a requirement. Additional levels of successful authentication are necessary for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/27/2025). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-31391). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Virtualization Software

Vendor

• Docker

Name

• Desktop

Version

• 4.46.0

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion