Medium severity · published Oct 27, 2026
CVE-2026-114409
Docker Desktop logs can expose stored third-party credentials
New
5.7
CVSS
0.1%
EPSS
No
On KEV
Description
Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are not Docker account tokens. Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DD
Docker Desktop · Docker
4.39.0 before 4.97.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114409
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114409
docs.docker.com
https://docs.docker.com/desktop/release-notes/#4970
docs.docker.com
https://docs.docker.com/desktop/troubleshoot-and-support/troubleshoot/#check-the-logs
More from Docker Desktop
9.8
CVE-2024-8696
A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2.
9.8
CVE-2024-8695
A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2.
8.9
CVE-2024-9348
Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view
7.8
CVE-2026-2664
Out of bounds read vulnerability in grpcfuse kernel module
7.8
CVE-2025-3224
Elevation of Privilege in Docker Desktop for Windows during Upgrade due to Insecure Directory Deletion