All vulnerabilities
CVE-2026-114409

Docker Desktop logs can expose stored third-party credentials

Docker Docker DesktopContainers & cloud
Open in ThreatlineRecord JSON
CVSS
5.7Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in4.97.0Fixed versionCVE List
Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are not Docker account tokens. Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps.

Text from CVE List

Affected versions 2

  • Docker Desktopaffected: 4.39.0 before 4.97.0CVE List
  • Docker Desktopunaffected: 4.97.0CVE List

References 2