# CVE-2026-114409: Docker Desktop logs can expose stored third-party credentials

CVE-2026-114409 is fixed in Docker Desktop on 2 platforms, first by Docker Desktop 4.97.0, released October 23, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-114409
- Priority: Routine
- CVSS: 5.7
- EPSS: 0.0011
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 27, 2026
- Weakness: CWE-532: Insertion of Sensitive Information into Log File
- Vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-114409

## Description

Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are not Docker account tokens. Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Docker Desktop | 4.97.0 | [Docker Desktop 4.97.0](https://patchblox.com/security/data/fix/windows-app/docker.dockerdesktop-4.97.0.md) | Oct 23, 2026 |
| macOS | Docker Desktop | 4.97.0 | [Docker Desktop 4.97.0](https://patchblox.com/security/data/fix/macos/com.docker.docker-4.97.0.md) | Oct 23, 2026 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.