The Docker Desktop MCP server contains a vulnerability where sensitive information, including credentials, is stored in plaintext. An attacker with the ability to execute low-privileged code locally can exploit this flaw to disclose these credentials, potentially leading to further compromise. The vulnerability is present in a beta version of Docker Desktop and has been publicly disclosed by the Zero Day Initiative with a CVSS score of 5.5. The vendor has indicated that this issue will not receive a CVE and impacts only beta software. No patch or official fix details are provided in the advisory.

Local attackers with low-privileged code execution can disclose sensitive information stored in plaintext by the MCP server in Docker Desktop beta versions. This disclosure could lead to credential exposure and subsequent compromise of the affected system or Docker environment. There is no indication of remote exploitation or denial of service. No known active exploitation has been reported.

The vendor advisory states the issue affects a beta version and does not assign a CVE. No official patch or remediation details are provided. Users should avoid running the affected beta version or restrict local code execution privileges to trusted users only. Monitor the vendor advisory for any updates regarding official fixes or mitigations. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.