Logging Vulnerability in Docker Desktop Affects User Data Security
CVE-2026-123082

5.7MEDIUM

Key Information:

Vendor

Docker

Status
Docker Desktop
Vendor
CVE Published:
10 November 2026

What is CVE-2026-123082?

A vulnerability in Docker Desktop versions prior to 4.94.0 allows for the exposure of a signed-in user's Docker Hub access token, resulting from cleartext logging in application logs and diagnostics bundles. Specifically, when Docker Desktop requests user tokens from the backend, these tokens are inadvertently logged without redaction, leaving them vulnerable to access by any individual who has read access to the log files. This flaw can enable attackers to misuse the token for unauthorized access to the user's Docker Hub data while the token remains valid. As of version 4.94.0, Docker Desktop has addressed this issue by implementing redaction for these sensitive payloads. However, existing logs from previous versions will continue to contain these exposed tokens, necessitating caution for users who have upgraded.

Affected Version(s)

Docker Desktop Linux 4.43.0 < 4.94.0

Docker Desktop Linux 4.94.0

References

https://docs.docker.com/desktop/release-notes/#4940
release-notes

CVSS V4

Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.