Vulnerability in Docker Desktop

[ Description ]Official description

Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are not Docker account tokens. Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps.

[ Fixes ]Fixes and patches

• Security bulletin: Docker #docker-desktop-4970-security-update-cve-2026-114409Vendor patch or bulletin · CERT-FR · docs.docker.com/security/security-announcements, cited by CERT-FR CERTFR-2026-AVI-1401
• Security bulletin: Docker #docker-desktop-4970-security-update-cve-2026-99999Vendor patch or bulletin · CERT-FR · docs.docker.com/security/security-announcements, cited by CERT-FR CERTFR-2026-AVI-1401

[ Advisories ]Government CERT advisories

• CERT-FR28 Oct 2026CERTFR-2026-AVI-1401

  Multiple vulnerabilities in Docker Desktop Translated from French

  Multiple vulnerabilities have been discovered in Docker Desktop. They allow an attacker to cause a breach of data confidentiality and a security policy bypass.

  CVE-2026-99999CVE-2026-114409
• BSI CERT-Bund27 Oct 2026WID-SEC-2026-4186

  Docker Desktop: Vulnerability allows information disclosure Translated from German

  CVE-2026-114409

[ References ]References

• docs.docker.com/desktop/release-notes
• docs.docker.com/desktop/troubleshoot-and-support/troubleshoot