CVE-2026-114409

Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are not Docker account tokens. Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps.

• CWE-532

• https://docs.docker.com/desktop/release-notes/#4970
• https://docs.docker.com/desktop/troubleshoot-and-support/troubleshoot/#check-the-logs

Published

Oct 27, 2026

Last Modified

Oct 27, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114402Trudesk through 1.2.11 contains a path traversal and authori…4.3
• CVE-2026-114403PHPOffice PHPPresentation through 1.2.0 contains an insecure…8.1
• CVE-2026-114404PHPOffice PHPPresentation 1.2.0 contains a cross-site script…6.1
• CVE-2026-114405Improper validation of array index vulnerability in Velneo v…8.7
• CVE-2026-114406The system certificate authority (CA) store in Red Hat produ…6.8
• CVE-2026-114407e107 CMS before 2.3.13 contains a reflected cross-site scrip…6.1
• CVE-2026-11441A vulnerability was identified in theonedev onedev up to 15.…6.3
• CVE-2026-11442Allegra exportReport Directory Traversal Information Disclos…6.5
• CVE-2026-114422The Enable Media Replace WordPress plugin before 4.2.3 does …7.5
• CVE-2026-114429The WPVR WordPress plugin before 9.0.3 does not properly sa…6.8
• CVE-2026-11443Allegra downloadAttachment Cross-Site Scripting Authenticati…4.6
• CVE-2026-114437In the Golang Chi web framework, the ClientIPFromXFF middlew…4.8