PT-2026-141722
CVE-2026-123082
·
Published
2026-11-10
·
Updated
2026-11-10
Description by
CVSS 4.0
5.7
MediumMetricsAV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Docker Desktop versions prior to 4.94.0
Description
Docker Desktop writes the signed-in user's Docker Hub access token, which is a JSON Web Token (JWT), in cleartext to application logs and diagnostics bundles. This occurs because IPC payloads consisting of bare JSON strings or arrays are not redacted before logging, and a component logs the token during backend requests. An attacker with read access to these files can obtain the token to read and modify the user's Docker Hub data while the token is valid.
Recommendations
Update to version 4.94.0 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾