Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Docker | Docker Desktop | unaffected |
|
No data.
No data.
No data available yet.
Vendor Workaround
Restrict access to existing local application logs and diagnostics bundles that may contain tokens, and delete or sanitize copies of them.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://docs.docker.com/desktop/release-notes/#4940 |
|
Tue, 10 Nov 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token (a JWT) in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before logging, and a Docker Desktop component logged the token when it requested it from the backend. An attacker with read access to these files could obtain the token and use it to read and modify the user's Docker Hub data as that user while the token remains valid. Docker Desktop 4.94.0 redacts these payloads. The fix does not rewrite logs written by earlier versions, which can still contain tokens after upgrading. | |
| Title | Docker Desktop logs can expose the Docker Hub access token | |
| First Time appeared |
Docker
Docker desktop |
|
| Weaknesses | CWE-532 | |
| CPEs | cpe:2.3:a:docker:desktop:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Docker
Docker desktop |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: Docker
Published:
Updated: 2026-11-10T14:37:24.600Z
Reserved: 2026-11-05T10:56:32.202Z
Link: CVE-2026-123082
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.