Skip to content

4.97 CVE #26462

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aevesdocker merged 2 commits into from
Oct 27, 2026
Merged

4.97 CVE #26462

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9992544
4.97 rn update
aevesdocker Oct 27, 2026
528b75e
4.97 rn update
aevesdocker Oct 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion content/manuals/desktop/release-notes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,6 @@ For more frequently asked questions, see the [FAQs](/manuals/desktop/troubleshoo

{{< desktop-install-v2 all=true win_arm_release="Early Access" version="4.97.0" build_path="/244584/" >}}


### Bug fixes and enhancements

#### For all platforms
Expand Down Expand Up @@ -64,6 +63,11 @@ For more frequently asked questions, see the [FAQs](/manuals/desktop/troubleshoo
- Fixed a bug where a failed update could put back Start Menu and desktop shortcuts that had been deleted on purpose.
- `--user` mode is now the default for new Docker Desktop `.EXE` installations.

### Security

- Addressed [CVE-2026-114409](https://www.cve.org/cverecord?id=CVE-2026-114409), where Docker Desktop could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles. This release also cleans up existing host logs and crash dumps. These OAuth tokens are not Docker account tokens. If you've generated or shared diagnostics bundles with Docker Desktop 4.96.x or earlier, or kept copies of Docker Desktop logs elsewhere, delete or sanitize them.
- Addressed [CVE-2026-99999](https://www.cve.org/cverecord?id=CVE-2026-99999), a kernel vulnerability where a container could exploit bad IPv4 checksum metadata via TUN or `AF_PACKET` to corrupt the VM's network stack.

## 4.96.3

{{< release-date date="2026-10-22" >}}
Expand Down
32 changes: 32 additions & 0 deletions content/manuals/security/security-announcements.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,38 @@ aliases:

[Subscribe to security RSS feed](/security/security-announcements/index.xml)

## Docker Desktop 4.97.0 security update: CVE-2026-114409

A vulnerability in Docker Desktop was fixed on October 26 in the
[4.97.0](/manuals/desktop/release-notes.md#4970) release:

- Addressed [CVE-2026-114409](https://www.cve.org/cverecord?id=CVE-2026-114409),
where Docker Desktop could write third-party API keys and OAuth access tokens
in cleartext to local application logs and diagnostics bundles. This affected
Docker Desktop versions before 4.97.0 and was caused by insufficient IPC
payload redaction. An attacker with read access to these files could obtain
the credentials. These OAuth tokens are not Docker account tokens.

Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs
containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes
the issue and includes cleanup of existing host logs and crash dumps.

If you've generated or shared diagnostics bundles with Docker Desktop 4.96.x
or earlier, or kept copies of Docker Desktop logs elsewhere, delete or
sanitize them.

Update to Docker Desktop
[4.97.0](/manuals/desktop/release-notes.md#4970).

## Docker Desktop 4.97.0 security update: CVE-2026-99999

A vulnerability in Docker Desktop was fixed on October 26 in the
[4.97.0](/manuals/desktop/release-notes.md#4970) release:

- Addressed [CVE-2026-99999](https://www.cve.org/cverecord?id=CVE-2026-99999),
a kernel vulnerability where a container could exploit bad IPv4 checksum
metadata via TUN or `AF_PACKET` to corrupt the VM's network stack.

## Docker Sandboxes response to eMudhra CA compromise

_Last updated October 21, 2026_
Expand Down
Loading