CVE-2026-114409

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114409", "assignerOrgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e", "state": "PUBLISHED", "assignerShortName": "Docker", "dateReserved": "2026-10-21T12:08:15.318Z", "datePublished": "2026-10-27T12:25:57.894Z", "dateUpdated": "2026-11-04T20:28:50.246Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Linux", "MacOS", "Windows"], "product": "Docker Desktop", "vendor": "Docker", "cpes": ["cpe:2.3:a:docker:desktop:*:*:*:*:*:*:*:*"], "versions": [{"version": "4.39.0", "status": "affected", "lessThan": "4.97.0", "versionType": "semver"}, {"version": "4.97.0", "status": "unaffected", "versionType": "semver"}]}], "configurations": [{"lang": "en", "value": "Exposure requires third-party credentials to have been written to local application logs or diagnostics bundles and an attacker with read access to those files."}], "descriptions": [{"lang": "en", "value": "Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are not Docker account tokens. Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps."}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "baseScore": 5.7, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "description": "CWE-532: Insertion of Sensitive Information into Log File", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e", "shortName": "Docker", "dateUpdated": "2026-10-27T12:25:57.894Z"}, "references": [{"tags": ["release-notes"], "url": "https://docs.docker.com/desktop/release-notes/#4970"}, {"tags": ["product"], "url": "https://docs.docker.com/desktop/troubleshoot-and-support/troubleshoot/#check-the-logs"}], "source": {"discovery": "UNKNOWN"}, "title": "Docker Desktop logs can expose stored third-party credentials", "workarounds": [{"lang": "en", "value": "Restrict access to existing local application logs and diagnostics bundles that may contain credentials, and revoke or rotate exposed credentials."}], "solutions": [{"lang": "en", "value": "Upgrade to Docker Desktop 4.97.0 or later."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-04T18:42:45.967622Z", "id": "CVE-2026-114409", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T20:28:50.246Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-114409", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-04T18:42:45.967622Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T18:42:46.863Z"}}], "cna": {"title": "Docker Desktop logs can expose stored third-party credentials", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.7, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}}], "affected": [{"cpes": ["cpe:2.3:a:docker:desktop:*:*:*:*:*:*:*:*"], "vendor": "Docker", "product": "Docker Desktop", "versions": [{"status": "affected", "version": "4.39.0", "lessThan": "4.97.0", "versionType": "semver"}, {"status": "unaffected", "version": "4.97.0", "versionType": "semver"}], "platforms": ["Linux", "MacOS", "Windows"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to Docker Desktop 4.97.0 or later."}], "references": [{"url": "https://docs.docker.com/desktop/release-notes/#4970", "tags": ["release-notes"]}, {"url": "https://docs.docker.com/desktop/troubleshoot-and-support/troubleshoot/#check-the-logs", "tags": ["product"]}], "workarounds": [{"lang": "en", "value": "Restrict access to existing local application logs and diagnostics bundles that may contain credentials, and revoke or rotate exposed credentials."}], "descriptions": [{"lang": "en", "value": "Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are not Docker account tokens. Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532: Insertion of Sensitive Information into Log File"}]}], "configurations": [{"lang": "en", "value": "Exposure requires third-party credentials to have been written to local application logs or diagnostics bundles and an attacker with read access to those files."}], "providerMetadata": {"orgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e", "shortName": "Docker", "dateUpdated": "2026-10-27T12:25:57.894Z"}}}, "cveMetadata": {"cveId": "CVE-2026-114409", "state": "PUBLISHED", "dateUpdated": "2026-11-04T20:28:50.246Z", "dateReserved": "2026-10-21T12:08:15.318Z", "assignerOrgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e", "datePublished": "2026-10-27T12:25:57.894Z", "assignerShortName": "Docker"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:docker:desktop:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "platforms": ["Linux", "MacOS", "Windows"], "product": "Docker Desktop", "vendor": "Docker", "versions": [{"lessThan": "4.97.0", "status": "affected", "version": "4.39.0", "versionType": "semver"}, {"status": "unaffected", "version": "4.97.0", "versionType": "semver"}]}], "source": "security@docker.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are not Docker account tokens. Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps."}], "id": "CVE-2026-114409", "lastModified": "2026-11-04T21:17:50.210", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@docker.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-114409", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-04T18:42:45.967622Z", "version": "2.0.3"}}]}, "published": "2026-10-27T13:16:56.717", "references": [{"source": "security@docker.com", "url": "https://docs.docker.com/desktop/release-notes/#4970"}, {"source": "security@docker.com", "url": "https://docs.docker.com/desktop/troubleshoot-and-support/troubleshoot/#check-the-logs"}], "sourceIdentifier": "security@docker.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "security@docker.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux", "macos", "windows"], "status": "affected", "versions": {"scheme": "semver", "value": "[4.39.0,4.97.0)"}}, {"platform": ["linux", "macos", "windows"], "status": "unaffected", "versions": {"scheme": "semver", "value": "4.97.0"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Docker Desktop", "source": "cna", "vendor": "Docker"}, "product": "desktop", "vendor": "docker"}], "created": "2026-10-27T13:30:04.849876+00:00", "updated": "2026-10-27T13:45:02.344542+00:00", "vendors": ["docker", "docker$PRODUCT$desktop"]}