From 99925441212ad9080f2aafbe0b3a3ae994d75fc1 Mon Sep 17 00:00:00 2001 From: aevesdocker Date: Tue, 27 Oct 2026 12:12:32 +0000 Subject: [PATCH 1/2] 4.97 rn update Signed-off-by: aevesdocker --- content/manuals/desktop/release-notes.md | 6 +++- .../security/security-announcements.md | 32 +++++++++++++++++++ 2 files changed, 37 insertions(+), 1 deletion(-) diff --git a/content/manuals/desktop/release-notes.md b/content/manuals/desktop/release-notes.md index c7c7b1148b6..8758965f30d 100644 --- a/content/manuals/desktop/release-notes.md +++ b/content/manuals/desktop/release-notes.md @@ -30,7 +30,6 @@ For more frequently asked questions, see the [FAQs](/manuals/desktop/troubleshoo {{< desktop-install-v2 all=true win_arm_release="Early Access" version="4.97.0" build_path="/244584/" >}} - ### Bug fixes and enhancements #### For all platforms @@ -64,6 +63,11 @@ For more frequently asked questions, see the [FAQs](/manuals/desktop/troubleshoo - Fixed a bug where a failed update could put back Start Menu and desktop shortcuts that had been deleted on purpose. - `--user` mode is now the default for new Docker Desktop `.EXE` installations. +### Security + +- Addressed [CVE-2026-114409](https://www.cve.org/cverecord?id=CVE-2026-114409), where Docker Desktop could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles. This release also cleans up existing host logs and crash dumps. These OAuth tokens are not Docker account tokens. +- Addressed [CVE-2026-99999](https://www.cve.org/cverecord?id=CVE-2026-99999), a kernel vulnerability where a container could exploit bad IPv4 checksum metadata via TUN or `AF_PACKET` to corrupt the VM's network stack. + ## 4.96.3 {{< release-date date="2026-10-22" >}} diff --git a/content/manuals/security/security-announcements.md b/content/manuals/security/security-announcements.md index 5eb87c65bf1..450317b2636 100644 --- a/content/manuals/security/security-announcements.md +++ b/content/manuals/security/security-announcements.md @@ -17,6 +17,38 @@ aliases: [Subscribe to security RSS feed](/security/security-announcements/index.xml) +## Docker Desktop 4.97.0 security update: CVE-2026-114409 + +A vulnerability in Docker Desktop was fixed on October 26 in the +[4.97.0](/manuals/desktop/release-notes.md#4970) release: + +- Addressed [CVE-2026-114409](https://www.cve.org/cverecord?id=CVE-2026-114409), + where Docker Desktop could write third-party API keys and OAuth access tokens + in cleartext to local application logs and diagnostics bundles. This affected + Docker Desktop versions before 4.97.0 and was caused by insufficient IPC + payload redaction. An attacker with read access to these files could obtain + the credentials. These OAuth tokens are not Docker account tokens. + + Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs + containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes + the issue and includes cleanup of existing host logs and crash dumps. + + If you've generated or shared diagnostics bundles with Docker Desktop 4.96.x + or earlier, or kept copies of Docker Desktop logs elsewhere, delete or + sanitize them. + +Update to Docker Desktop +[4.97.0](/manuals/desktop/release-notes.md#4970). + +## Docker Desktop 4.97.0 security update: CVE-2026-99999 + +A vulnerability in Docker Desktop was fixed on October 26 in the +[4.97.0](/manuals/desktop/release-notes.md#4970) release: + +- Addressed [CVE-2026-99999](https://www.cve.org/cverecord?id=CVE-2026-99999), + a kernel vulnerability where a container could exploit bad IPv4 checksum + metadata via TUN or `AF_PACKET` to corrupt the VM's network stack. + ## Docker Sandboxes response to eMudhra CA compromise _Last updated October 21, 2026_ From 528b75e18b15abe915cf3a5316e1ef474ba29350 Mon Sep 17 00:00:00 2001 From: aevesdocker Date: Tue, 27 Oct 2026 12:14:42 +0000 Subject: [PATCH 2/2] 4.97 rn update Signed-off-by: aevesdocker --- content/manuals/desktop/release-notes.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/manuals/desktop/release-notes.md b/content/manuals/desktop/release-notes.md index 8758965f30d..7207e42f3b7 100644 --- a/content/manuals/desktop/release-notes.md +++ b/content/manuals/desktop/release-notes.md @@ -65,7 +65,7 @@ For more frequently asked questions, see the [FAQs](/manuals/desktop/troubleshoo ### Security -- Addressed [CVE-2026-114409](https://www.cve.org/cverecord?id=CVE-2026-114409), where Docker Desktop could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles. This release also cleans up existing host logs and crash dumps. These OAuth tokens are not Docker account tokens. +- Addressed [CVE-2026-114409](https://www.cve.org/cverecord?id=CVE-2026-114409), where Docker Desktop could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles. This release also cleans up existing host logs and crash dumps. These OAuth tokens are not Docker account tokens. If you've generated or shared diagnostics bundles with Docker Desktop 4.96.x or earlier, or kept copies of Docker Desktop logs elsewhere, delete or sanitize them. - Addressed [CVE-2026-99999](https://www.cve.org/cverecord?id=CVE-2026-99999), a kernel vulnerability where a container could exploit bad IPv4 checksum metadata via TUN or `AF_PACKET` to corrupt the VM's network stack. ## 4.96.3