Vulnerability · Published Apr 29, 2025 · Assigned by Docker
CVE-2025-4095Registry Access Management (RAM) policies not applied when sign-in enforcement is configured via a configuration profile
Medium 4.3
In plain English
A medium-severity missing authorization in Docker Desktop from Docker. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities).
Official description
Registry Access Management (RAM) is a security feature allowing administrators to restrict access for their developers to only allowed registries. When a MacOS configuration profile is used to enforce organization sign-in, the RAM policies are not being applied, which would allow Docker Desktop users to pull down unapproved, and potentially malicious images from any registry.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Docker | Docker Desktop | 4.36.0 – before 4.41.0 |
Weakness: CWE-862 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N