CVE-2026-123082
Docker Desktop logs can expose the Docker Hub access token
Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token (a JWT) in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before logging, and a Docker Desktop component logged the token when it requested it from the backend. An attacker with read access to these files could obtain the token and use it to read and modify the user's Docker Hub data as that user while the token remains valid. Docker Desktop 4.94.0 redacts these payloads. The fix does not rewrite logs written by earlier versions, which can still contain tokens after upgrading.
Fixes and workarounds
Workaround
Restrict access to existing local application logs and diagnostics bundles that may contain tokens, and delete or sanitize copies of them.
Source: CNA: DockerAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| Docker Desktop Docker Platforms: Linux, MacOS, Windows |
≥ 4.43.0; < 4.94.0 (affected, semver) 4.94.0 (unaffected, semver) Other versions: unaffected |
CNA: Docker |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 4.0 / 5.7 medium |
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N | CNA: Docker |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://docs.docker.com/desktop/release-notes/#4940CNA: Docker · release-notes
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.