{“lastseen”:”2026-02-04T13:28:43″,”description”:”Exploit Title: Docker Desktop 4.44.3 – Unauthenticated API Exposure Date: 2025-10-06 Exploit Author: OilSeller2001 Vendor Homepage: https:\/\/www.docker.com\/ Software Link: https:\/\/www.docker.com\/products\/docker-desktop\/ Version: Affected on Windows and…”,”published”:”2026-02-04T00:00:00″,”modified”:”2026-02-04T00:00:00″,”type”:”exploitdb”,”title”:”Docker Desktop 4.44.3 – Unauthenticated API Exposure”,”source”:””,”references”:””,”id”:”EDB-ID:52472″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-9074″],”sourceData”:”# Exploit Title: Docker Desktop 4.44.3 – Unauthenticated API Exposure\\r\\n# Date: 2025-10-06\\r\\n# Exploit Author: OilSeller2001\\r\\n# Vendor Homepage: https:\/\/www.docker.com\/\\r\\n# Software Link: https:\/\/www.docker.com\/products\/docker-desktop\/\\r\\n# Version: Affected on Windows and macOS versions prior to 4.44.3\\r\\n# Tested on: Windows 11 + Docker Desktop 4.43.0\\r\\n# Exploit Type: Remote, Local, Shellcode\\r\\n# Platform: Windows\\r\\n# CVE: CVE-2025-9074\\r\\n\\r\\n# Description:\\r\\nThis PoC script exploits a security misconfiguration in the unauthenticated exposure of the Docker Engine API. \\r\\nBy sending crafted API requests directly to the Docker daemon, the script creates and starts a specially prepared container. \\r\\nThe container leverages the bind mount feature to map sensitive directories from the host filesystem into the container, effectively granting arbitrary access to the host. \\r\\nThis results in a high-privilege remote code execution scenario.\\r\\n\\r\\n# Vulnerability Details:\\r\\nThe Docker Engine API (TCP port 2375) can be exposed without TLS authentication via the \\”Expose daemon on tcp:\/\/localhost:2375 without TLS\\” option in Docker Desktop. \\r\\nIf this option is enabled, any local or remote attacker with network access to the exposed port can control the Docker daemon without authentication.\\r\\n\\r\\n# Usage:\\r\\n1. Expose the Docker daemon on TCP 2375 without TLS (testing environment only).\\r\\n2. Run the PoC against the target:\\r\\n python3 poc_cve_2025_9074.py \\u003ctarget_ip\\u003e:2375\\r\\n3. The script will:\\r\\n – Check API availability\\r\\n – Pull an image\\r\\n – Create a malicious container with bind mounts to the host filesystem\\r\\n – Start the container, allowing access to host files\\r\\n\\r\\n# Mitigation:\\r\\n- Disable the unauthenticated Docker API exposure after testing.\\r\\n- Use TLS certificates if remote API access is required.\\r\\n- Restrict network access to port 2375 via firewall rules.\\r\\n\\r\\n# PoC Download Link:\\r\\nhttps:\/\/github.com\/OilSeller2001\/PoC-for-CVE-2025-9074″,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52472″,”cvss”:{“score”:9.3,”severity”:”CRITICAL”,”vector”:”CVSS:4.0\/AV:L\/AC:L\/AT:N\/PR:N\/UI:P\/VC:H\/SC:H\/VI:H\/SI:H\/VA:H\/SA:H”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52472″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-04T13:28:43″,”description”:”Exploit Title: Docker Desktop 4.44.3 – Unauthenticated API Exposure Date: 2025-10-06 Exploit Author: OilSeller2001 Vendor Homepage: https:\/\/www.docker.com\/ Software Link: https:\/\/www.docker.com\/products\/docker-desktop\/ Version: Affected on Windows and…”,”published”:”2026-02-04T00:00:00″,”modified”:”2026-02-04T00:00:00″,”type”:”exploitdb”,”title”:”Docker…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,55,12,40,13,7,11,5],"class_list":["post-38997","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-93","tag-exploit","tag-exploitdb","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n