---
id: "CVE-2026-123082"
page: "https://infrastack.ai/live/CVE-2026-123082"
kind: "vulnerability"
aliases: ["CVE-2026-123082"]
title: "Docker Desktop: logs and diagnostics leak Docker Hub access tokens in cleartext"
severity: "medium"
cvss: 5.7
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["docker-desktop", "docker-hub", "macos", "runtime", "windows"]
not_affected_if: ["docker-desktop-4.94.0-or-later", "not-signed-in-to-docker-hub"]
published_at: "2026-11-10T15:17:16+00:00"
first_seen_at: "2026-11-10T15:22:22+00:00"
updated_at: "2026-11-10T15:22:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123082", "first_seen_at": "2026-11-10T15:22:22+00:00"}]
exploit_sources: []
---

# Docker Desktop: logs and diagnostics leak Docker Hub access tokens in cleartext

Link for people: https://infrastack.ai/live/CVE-2026-123082 (this .md is for agents)

Docker Desktop before 4.94.0 wrote the signed-in user's Docker Hub access token into application logs and diagnostics bundles. Anyone who can read those files can use the token to read and modify that user's Docker Hub data while the token stays valid.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Docker Desktop version (Docker Desktop settings or About dialog) and confirm it is at least `4.94.0`.
- Search existing Docker Desktop logs and diagnostics bundles for JWT-like strings written before upgrading; the sources say old logs are not rewritten by the fix.

## Timeline

- 2026-11-10T15:22:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123082

## From the sources

Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token (a JWT) in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before logging, and a Docker Desktop component logged the token when it requested it from the backend. An attacker with read access to these files could obtain the token and use it to read and modify the user's Docker Hub data as that user while the token remains valid. Docker Desktop 4.94.0 redacts these payloads. The fix does not rewrite logs written by earlier versions, which can still contain tokens after upgrading.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_