TL;DR
['Local attackers can exploit a vulnerability to disclose sensitive information stored in cleartext on Docker Desktop installations.', 'Requires low-privilege system access for exploitation, rated CVSS 5.5 by ZDI.']
What happened
['A local attacker with low privilege code execution capability can exploit the MCP server in Docker Desktop to retrieve sensitive data stored in clear text.']
Why it matters for ops
['The vulnerability arises from improper handling of sensitive information, allowing for unauthorized access and potential data exposure.']
Mitigation
- Enable encryption for storing sensitive information within the MCP server.
- Restrict user privileges and monitor unauthorized accesses to sensitive data.
Action items
- Update Docker Desktop to the latest version with security patches.
- Review and encrypt all sensitive data stored on Docker installations.
- Implement strict access control policies for Docker environments.
Detection IOCs
- Unencrypted storage of sensitive data on Docker Desktop installations.
- Unexpected access to cleartext sensitive data in logs or files.