Medium severity · published Oct 27, 2026
CVE-2026-114409
Docker Desktop logs can expose stored third-party credentials
New
5.7
CVSS
–
EPSS
No
On KEV
Description
Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are not Docker account tokens. Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DD
Docker Desktop · Docker
4.39.0 before 4.97.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114409
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114409
docs.docker.com
https://docs.docker.com/desktop/release-notes/#4970
docs.docker.com
https://docs.docker.com/desktop/troubleshoot-and-support/troubleshoot/#check-the-logs
More from Docker Desktop
9.8
CVE-2024-8696
A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2
9.8
CVE-2024-8695
A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2
7.8
CVE-2026-2664
Out of bounds read vulnerability in grpcfuse kernel module
7.8
CVE-2025-3224
A vulnerability in the update process of Docker Desktop for Windows versions prior to 4.41.0 could allow a local, low-privileged attacker to escalate privileges to SYSTEM
7.8
CVE-2022-37326
Docker Desktop for Windows before 4.6.0 allows attackers to delete (or create) any file through the dockerBackendV2 windowscontainers/start API by controlling the pidfile field…