CVE-2026-114409: 
Docker Desktop vulnerability analysis and mitigation

CVE-2026-114409 is a credential exposure vulnerability in Docker Desktop that causes third-party API keys and OAuth access tokens to be written in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. It affects Docker Desktop versions 4.39.0 through 4.96.x (i.e., before 4.97.0). Partial mitigations were introduced in versions 4.94.0 and 4.95.0, but residual log files containing credentials could persist after upgrading. The vulnerability carries a CVSS v4.0 base score of 5.7 (Medium) (Docker Security, ENISA EUVD).

The root cause is classified as CWE-532 (Insertion of Sensitive Information into Log File). Docker Desktop's inter-process communication (IPC) layer failed to adequately redact sensitive payloads — including third-party API keys and OAuth access tokens (not Docker account tokens) — before writing them to local application logs and diagnostics/crash dump bundles. Exploitation requires local read access to the affected log files or diagnostics bundles; no network access or elevated privileges are needed beyond the ability to read user-accessible files. Docker Desktop 4.94.0 and 4.95.0 addressed some known logging paths but did not retroactively clean up previously written logs, leaving residual credential exposure until the full fix in 4.97.0 (Docker Security, ENISA EUVD).

An attacker with local read access to the affected system — such as a co-located user, malicious process, or insider threat — could extract plaintext third-party API keys and OAuth tokens from Docker Desktop log files or diagnostics bundles. Compromised credentials could be used to access integrated third-party services, potentially enabling unauthorized data access, service abuse, or lateral movement into connected systems. Availability and integrity of the Docker Desktop host are not directly impacted; the primary risk is confidentiality of third-party service credentials (Docker Security, ENISA EUVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is 0.0, indicating very low probability of near-term exploitation based on current data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is limited to local access scenarios, reducing the overall attack surface (ENISA EUVD).

1. Gain local access: Obtain read access to the target system where Docker Desktop is installed (e.g., via a compromised local user account, malicious process running as the same user, or physical access).
2. Locate log files: Navigate to Docker Desktop's local application log directory (e.g., ~/Library/Containers/com.docker.docker/Data/log/ on macOS, %APPDATA%\Docker\log\ on Windows, or ~/.docker/desktop/log/ on Linux) or locate diagnostics/crash dump bundles generated by Docker Desktop.
3. Search for credentials: Use text search tools (e.g., grep, findstr) to scan log files for patterns matching API keys or OAuth token formats (e.g., bearer tokens, key-value pairs containing token, api_key, access_token).
4. Extract and abuse credentials: Copy the identified plaintext credentials and use them to authenticate against the corresponding third-party services for unauthorized access, data exfiltration, or further lateral movement (Docker Security, ENISA EUVD).

• File System: Presence of Docker Desktop log files or diagnostics bundles containing plaintext API keys or OAuth tokens in directories such as ~/Library/Containers/com.docker.docker/Data/log/ (macOS), %APPDATA%\Docker\log\ (Windows), or ~/.docker/desktop/log/ (Linux); crash dump files in Docker Desktop data directories on versions prior to 4.97.0.
• Logs: Unexpected or unauthorized access to Docker Desktop log files or diagnostics bundle archives, particularly by processes other than Docker Desktop itself.
• Process: Unusual processes (e.g., grep, findstr, scripting engines) scanning Docker Desktop log directories, especially if not initiated by the user or Docker Desktop.

Upgrade Docker Desktop to version 4.97.0 or later, which fully resolves the issue and includes automated cleanup of existing host logs and crash dumps containing credentials. Versions 4.94.0 and 4.95.0 provide partial mitigation by addressing known logging paths but do not clean up previously written logs. Organizations unable to upgrade immediately should manually delete Docker Desktop log files and diagnostics bundles, and rotate any third-party API keys or OAuth tokens that may have been exposed. Restrict read access to Docker Desktop log directories to minimize the risk of credential theft by other local users or processes (Docker Security, Docker Release Notes).

Docker published a security announcement and release notes for version 4.97.0 documenting the fix and cleanup behavior. Community discussion was noted on Mastodon (infosec.exchange), and the vulnerability was indexed by multiple threat intelligence aggregators shortly after disclosure. No significant controversy or widespread media coverage has been identified beyond standard vulnerability tracking (Docker Security).