Live › vulnerability › CVE-2026-114409
Go to dashboardDocker Desktop before 4.97.0 wrote third-party API keys and OAuth access tokens in cleartext into local application logs and diagnostics bundles. Anyone who can read those files on the machine can take the credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 13:31 UTC. All times on this page are UTC.
Developers and teams running Docker Desktop on their workstations before 4.97.0 who use third-party API keys or OAuth integrations through local applications. The exposure is through local log and diagnostics files, so a shared machine or a bundle shared for support widens it. Teams on Docker Engine on Linux servers without Docker Desktop are not described as affected.
No product ranges from the sources yet.
docker version or open Docker Desktop's About panel to confirm the installed version is below 4.97.04.97.0 or later, which fixes the issue and cleans up existing host logs and crash dumps4.94.0 or 4.95.0 addressed known logging paths, but logs with credentials can remain, so upgrade to 4.97.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are not Docker account tokens. Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps.
This page as .md · .json · in your agent: get_signal("CVE-2026-114409")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.