CVE-2026-114409
Received Received - Intake

Docker Desktop Credential Exposure via Insufficient IPC Redaction

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: Docker Inc.

Description
Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are not Docker account tokens. Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-114409
EUVD
EUVD-2026-110827

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Docker Docker Desktop 4.39.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Docker Desktop before version 4.97.0 had a flaw where third-party API keys and OAuth access tokens were written in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. This allowed attackers with file read access to steal these credentials. The issue persisted even after upgrading to versions 4.94.0 or 4.95.0, as existing logs containing credentials remained.

Detection Guidance

Check Docker Desktop logs and diagnostics bundles for exposed third-party API keys or OAuth tokens. Search for sensitive data in files like application logs or crash dumps. Use commands like 'grep' to scan for patterns in Docker logs or system files.

Impact Analysis

If you use Docker Desktop before version 4.97.0, an attacker with access to your system could retrieve stored API keys or OAuth tokens from log files. This could lead to unauthorized access to third-party services, data breaches, or further exploitation of your accounts.

Compliance Impact

This vulnerability could violate GDPR or HIPAA by exposing sensitive credentials or tokens, leading to unauthorized data access. Logs containing such data may be considered unsecured personal or health information, risking non-compliance with data protection requirements.

Mitigation Strategies

Upgrade Docker Desktop to version 4.97.0 or later. Review and remove any existing logs or diagnostics bundles containing credentials. Ensure no sensitive data remains in host logs or crash dumps after upgrading.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114409. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart