Quick answers
- Is CVE-2026-114409 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-114409 being exploited in the wild.
- How severe is CVE-2026-114409?
- Informational severity, published 27 October 2026.
- Which products and versions are affected?
- Docker Desktop before 4.97.0.
- Is there a fix for CVE-2026-114409?
- Yes: fixed in Docker Desktop 4.97.0. Until then: Upgrade to Docker Desktop 4.97.0 or later, which includes automatic cleanup of existing host logs and crash dumps containing credentials. Users on earlier versions should manually delete local log and diagnostic files.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-27"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-114409 attacked?
- It is attacked with local access, in a web application.
- Am I affected by CVE-2026-114409?
- Check whether you run Docker Desktop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Docker Desktop 4.97.0
Upgrade to Docker Desktop 4.97.0 or later, which includes automatic cleanup of existing host logs and crash dumps containing credentials. Users on earlier versions should manually delete local log and diagnostic files.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-27"}]
Technical details
Insufficient IPC payload redaction in Docker Desktop causes third-party API keys and OAuth tokens to be written unencrypted to local logs and diagnostics archives. An attacker with read access to the local filesystem can extract these credentials. Versions 4.94.0 and 4.95.0 partially addressed known logging paths, but version 4.97.0 introduces automatic cleanup of legacy logs containing credentials.
Affected products
- Docker Desktop before 4.97.0