CVE-2026-114409: Docker Desktop logs can expose stored third-party credentials
Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are not Docker account tokens. Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Docker Desktopto a version that resolves this vulnerability.Fixed in 4.97.0
Event History
Frequently Asked Questions
Who could exploit the exposed credentials?
An attacker needs read access to the local Docker Desktop application logs or diagnostics bundles that contain the cleartext credentials. The issue concerns third-party API keys and OAuth access tokens, not Docker account tokens.
Which Docker Desktop versions require remediation?
Docker Desktop versions before 4.97.0 are affected. Versions 4.94.0 and 4.95.0 addressed known logging paths, but credentials written previously can remain in logs after upgrading.
What should be done about logs created before an upgrade?
Upgrade to Docker Desktop 4.97.0, which fixes the logging issue and cleans up existing host logs and crash dumps. Treat any third-party credentials that may have been present in accessible logs or diagnostic bundles as potentially exposed.